Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-40077: Beszel hub API lets any user view other systems

CVE-2026-40077 · published 6 months ago

Summary

The monitoring tool Beszel (versions before 0.18.7) allows a logged‑in user to request data for any system by guessing its ID, because the API does not verify the user’s rights. This could let an employee see information about servers they shouldn’t access. Upgrade Beszel to version 0.18.7 or later to add the proper access checks.

What to do

Update github.com henrygd to version 0.18.7.
Update beszel beszel to version 0.18.7 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	henrygd	<= 0.18.6 Fix: upgrade to 0.18.7
–	beszel	beszel	< 0.18.7 `cpe:2.3:a:beszel:beszel::::::::`

Original advisory text

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.

References

https://github.com/henrygd/beszel/releases/tag/v0.18.7 Product Release Notes
https://github.com/advisories/GHSA-5f5r-95pg-xrpm
https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm Exploit Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-40077 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40077... Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

3.1 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-184Incomplete List of Disallowed Inputs

Timeline

Published9 Apr 2026

Updated4 Nov 2026

First seen9 Apr 2026

Sources

CVE-2026-40077 · NVD

GHSA-5f5r-95pg-xrpm · GHSA

CVE-2026-40077 · OSV

Track software like this

Free during beta