VulnSocial

CVE-2026-40077Disclosure(beszel / beszel)

LOWCVSS 3.1 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch beszel beszel systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.

beszel CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-184

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • beszel

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-04-09); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
beszel
Products
beszel

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-09: 1Mentions · 2026-04-28: 1Patch / Workaround · 2026-04-09: 1Patch / Workaround · 2026-04-28: 1Technical Details · 2026-04-09: 1Technical Details · 2026-04-28: 104-0904-28
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-04-091
Disclosure1
2026-04-281
Patch1
Full discourse2 posts
  • cvereports@_cvereports
    Patch

    CVE-2026-40077: CVE-2026-40077: Insecure Direct Object Reference in Beszel Hub API CVE-2026-40077 is an Insecure Direct Object Reference (IDOR) vulnerability in the Beszel Hub API prior to version 0.18.7. The flaw allows authenticated users to bypass ... https://cvereports.com/reports/CVE-2026-40077

    Post summary

    The post reports an IDOR vulnerability in Beszel Hub API, noting that version 0.18.7 addresses the issue, but provides no PoC or evidence of active exploitation.

    0000047
    36 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-40077 Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that… https://www.cve.org/CVERecord?id=CVE-2026-40077

    Post summary

    CVE‑2026‑40077 affects Beszel’s API endpoints that lack proper system ID validation; updating to 0.18.7 or later resolves the issue.

    0000092
    57.0K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appbeszelbeszel---

Explore more

Back to dashboardbeszel CVEsbeszel vulnerabilities