CVE-2026-111386CWE-204

CVE-2026-111386

Medium · published October 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
10.7
In the wild
Unconfirmed
What it is

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00210 · 10.7th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2026-10-16T07:18Z
References (3)
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f · [email protected]https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw · [email protected]https://www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfig · [email protected]
EPSS history
Timeline
  • 17 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 16 OCT 01:17Z
    Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
    cvelistv5
  • 16 OCT 01:17Z
    Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
    cvelistv5