CVE-2026-94382CWE-639

CVE-2026-94382

Medium · published September 21, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
22.2
In the wild
Unconfirmed
What it is

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00305 · 22.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-21T18:17Z
References (7)
https://github.com/henrygd/beszel · [email protected]https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80 · [email protected]https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409 · [email protected]https://github.com/henrygd/beszel/releases/tag/v0.19.0 · [email protected]https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch · [email protected]https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference-via-user-alerts · [email protected]https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 23 SEP 03:49Z
    EPSS moved — → 0%
    epss
  • 21 SEP 12:59Z
    Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
    cvelistv5