CVE-2026-111386: Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nezhato a version that resolves this vulnerability.Fixed in 2.3.15
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Nezha member can exploit it. No user interaction is required, and the attack can be performed remotely.
Which deployments are affected?
Nezha versions from 1.7.0 through versions before 2.3.15 are affected. Deployments running 2.3.15 or later are outside the stated affected range.
What does an attacker need to do to enumerate other tenants' server IDs?
The attacker needs a valid member account and must send sequential server IDs to the getServerConfig and setServerConfig endpoints. They distinguish permission-denied responses from successful payloads to identify servers belonging to other tenants.