CVE-2026-94382

LOWCVSS 2.3 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-94382

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters1d
CVE-2026-94382: IDOR in Beszel before 0.19.0 lets any authenticated user create or delete alerts on systems they cannot access, leaking system names and metrics. CVSS 4.2, patch under review. Apply mitigations now. https://www.valtersit.com/cve/CVE-2026-94382 #CVE #infosec #cybersecurity #Beszel #CVEALERT #CVE #infosec #Linux #XSS #valtersit #snippet #SysAdmin #cybersecurity #devsecops #devops #developer #100daysofcode #git #github #gitlab #redteam #blueteam #ethicalhacker #cybersecurityawareness #cybersecuritynews #cybersecuritytips #python #hacker #kali #ubuntu #debian #docker
0000039
1.0K followersView on X

Explore more

Back to dashboard