CVE-2026-94382: Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Beszel user can exploit it. The attacker needs the ability to send POST or DELETE requests to the /api/beszel/user-alerts endpoints and supply system IDs for systems they are not authorized to access.
What information or actions can an attacker gain through exploitation?
An attacker can create alert rules for unauthorized systems and receive notifications that disclose those systems' names and metrics. They can also delete alerts on systems they cannot access.
Which versions are affected?
Beszel versions before 0.19.0 are affected. Updating to 0.19.0 or later addresses the affected user-alerts handlers.