Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Beszel lets logged-in users edit alerts for other systems

CVE-2026-94382 · published 28 days ago
Summary

The Beszel monitoring tool (versions before 0.19.0) allows any user who has logged in to create or delete alert rules for computers they do not have permission to view. This could let a malicious insider see names and performance data from other systems. Update Beszel to version 0.19.0 or later, or limit access to trusted users until the upgrade is applied.

What to do
  • Update henrygd beszel to version 0.19.0 or later.
Affected software
VendorProductAffected versions
henrygd beszel < 0.19.0
Original advisory text
Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published21 Sep 2026
Updated19 Oct 2026
First seen21 Sep 2026
Sources
CVE-2026-94382 · NVD
CVE-2026-94382 · MITRE
CVE-2026-94382 · OSV
GHSA-759g-ch5m-2gch · GHSA
Track software like this
Free during beta