CVE-2026-40077

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40077", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-09T00:39:12.205Z", "datePublished": "2026-04-09T19:27:39.364Z", "dateUpdated": "2026-04-13T20:19:45.967Z"}, "containers": {"cna": {"title": "Beszel has an IDOR in hub API endpoints that read system ID from URL parameter", "problemTypes": [{"descriptions": [{"cweId": "CWE-184", "lang": "en", "description": "CWE-184: Incomplete List of Disallowed Inputs", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm"}, {"name": "https://github.com/henrygd/beszel/releases/tag/v0.18.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/henrygd/beszel/releases/tag/v0.18.7"}], "affected": [{"vendor": "henrygd", "product": "beszel", "versions": [{"version": "< 0.18.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T19:27:39.364Z"}, "descriptions": [{"lang": "en", "value": "Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7."}], "source": {"advisory": "GHSA-5f5r-95pg-xrpm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T20:19:31.722610Z", "id": "CVE-2026-40077", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T20:19:45.967Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40077", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T20:19:31.722610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T20:19:41.922Z"}}], "cna": {"title": "Beszel has an IDOR in hub API endpoints that read system ID from URL parameter", "source": {"advisory": "GHSA-5f5r-95pg-xrpm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "henrygd", "product": "beszel", "versions": [{"status": "affected", "version": "< 0.18.7"}]}], "references": [{"url": "https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm", "name": "https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/henrygd/beszel/releases/tag/v0.18.7", "name": "https://github.com/henrygd/beszel/releases/tag/v0.18.7", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184: Incomplete List of Disallowed Inputs"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-09T19:27:39.364Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40077", "state": "PUBLISHED", "dateUpdated": "2026-04-13T20:19:45.967Z", "dateReserved": "2026-04-09T00:39:12.205Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-09T19:27:39.364Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "beszel", "vendor": "henrygd", "versions": [{"status": "affected", "version": "< 0.18.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:beszel:beszel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FEE9E0EA-91E0-4B0C-83AC-4FAF20D19328", "versionEndExcluding": "0.18.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7."}, {"lang": "es", "value": "Beszel es una plataforma de monitoreo de servidores. Antes de la versi\u00f3n 0.18.7, algunos puntos finales de la API en el hub de Beszel aceptan una ID de sistema proporcionada por el usuario y proceden sin verificaciones adicionales de que el usuario deber\u00eda tener acceso a ese sistema. Como resultado, cualquier usuario autenticado puede acceder a estas rutas para cualquier sistema si conoce la ID del sistema. Las ID de sistema son cadenas alfanum\u00e9ricas aleatorias de 15 caracteres y no est\u00e1n expuestas a todos los usuarios. Sin embargo, es te\u00f3ricamente posible que un usuario autenticado enumere una ID de sistema v\u00e1lida a trav\u00e9s de la API web. Para usar los puntos finales de los contenedores, el usuario tambi\u00e9n necesitar\u00eda enumerar una ID de contenedor, que es una cadena hexadecimal de 12 d\u00edgitos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 0.18.7."}], "id": "CVE-2026-40077", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40077", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T20:19:31.722610Z", "version": "2.0.3"}}]}, "published": "2026-04-09T20:16:27.230", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/henrygd/beszel/releases/tag/v0.18.7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/henrygd/beszel/security/advisories/GHSA-5f5r-95pg-xrpm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.18.7)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "beszel", "source": "cna", "vendor": "henrygd"}, "product": "beszel", "vendor": "henrygd"}], "analysis": {"en": {"generated_at": "2026-04-09T20:50:25.317696+00:00", "value": {"mitigation_remediation": ["Upgrade to version 0.18.7 or newer, which contains the fix for the IDOR", "If an upgrade is not immediately possible, limit user permissions so the hub API endpoints are only accessible to users who must have access to the respective systems", "Monitor API usage for abnormal access patterns that might indicate enumeration or exploitation attempts"], "summary": {"action": "Immediate patch", "impact": "Unauthorized access to system data"}, "threat_synthesis": {"affected_systems": "Vendors: henrygd:beszel. Affected versions are all releases prior to 0.18.7; version 0.18.7 and later contain the fix and are not vulnerable.", "description_and_impact": "Beszel, a server monitoring platform, contains an IDOR flaw in its hub API endpoints. The flaw allows any authenticated user to submit a system ID in the URL and the API returns information for that system without verifying the user\u2019s privileges. Because system IDs are random 15\u2011character alphanumeric strings, a user who knows or can enumerate a valid ID can read data from any system, potentially leaking sensitive configuration or monitoring information.", "risk_and_exploitability": "The CVSS score of 3.5 indicates low severity, yet the flaw provides unauthorized read access across the entire system inventory for any authenticated user. Exploitation requires only the ability to guess or enumerate system IDs and, for certain container endpoints, container IDs. The EPSS score is not available and the vulnerability is not listed in CISA\u2019s KEV catalog, implying limited public awareness or active exploitation. However, the relatively simple attack path and the fact that users can intentionally enumerate IDs and containers suggest the risk is non-trivial in environments where many systems are monitored."}}}}, "created": "2026-04-10T08:38:53.585305+00:00", "updated": "2026-04-10T09:29:37.962346+00:00", "vendors": ["henrygd", "henrygd$PRODUCT$beszel"]}