CVE-2026-40077: Beszel Hub Auth Bypass Vulnerability

CVE-2026-40077 Overview

CVE-2026-40077 is an Insecure Direct Object Reference (IDOR) vulnerability in Beszel, a server monitoring platform. Prior to version 0.18.7, certain API endpoints in the Beszel hub accept user-supplied system IDs without performing adequate authorization checks to verify whether the authenticated user should have access to that particular system. As a result, any authenticated user can access these routes for any system if they know or can enumerate the system's ID.

Critical Impact

Authenticated users can potentially access monitoring data for systems they are not authorized to view, leading to information disclosure of server metrics and container data.

Affected Products

• Beszel Server Monitoring Platform versions prior to 0.18.7

Discovery Timeline

• 2026-04-09 - CVE CVE-2026-40077 published to NVD
• 2026-04-09 - Last updated in NVD database

Technical Details for CVE-2026-40077

Vulnerability Analysis

This vulnerability stems from incomplete enforcement of authorization controls at specific API endpoints within the Beszel hub application. The affected endpoints accept a user-supplied system ID parameter and proceed to return data associated with that system without verifying whether the requesting user has legitimate access rights to that resource.

System IDs in Beszel are random 15-character alphanumeric strings, which provides some level of obscurity but does not constitute proper access control. While these IDs are not directly exposed to all users, the security advisory notes that it is theoretically possible for an authenticated user to enumerate valid system IDs via the web API.

For container-related endpoints, exploitation requires the attacker to also enumerate a container ID, which is a 12-digit hexadecimal string. This adds an additional layer of complexity to the attack but does not eliminate the underlying authorization bypass issue.

Root Cause

The root cause is classified under CWE-184 (Incomplete List of Disallowed Inputs), indicating that the application fails to properly validate and restrict access based on user authorization context. The API endpoints lack proper ownership or permission checks before returning system data, treating knowledge of a system ID as implicit authorization.

Attack Vector

The attack is network-based and requires low-privilege authentication. An attacker must first authenticate to the Beszel platform with any valid user account. Once authenticated, they can attempt to access API endpoints for systems belonging to other users by supplying system IDs that they should not have access to.

The exploitation process involves:

1. Authenticating to the Beszel platform with a valid user account
2. Enumerating or guessing valid system IDs (15-character alphanumeric strings)
3. Making API requests to vulnerable endpoints with the target system ID
4. For container endpoints, additionally enumerating 12-digit hexadecimal container IDs

Due to the random nature of the identifiers, successful exploitation depends on the attacker's ability to enumerate valid IDs through the API or obtain them through other means.

Detection Methods for CVE-2026-40077

Indicators of Compromise

• Unusual API request patterns from authenticated users attempting to access multiple system IDs
• Failed or successful access attempts to system resources that are not associated with the requesting user's account
• High volume of requests to system-related API endpoints that could indicate enumeration attempts

Detection Strategies

• Implement logging and monitoring for all system ID access attempts at API endpoints
• Configure alerts for access patterns where a user attempts to access systems outside their authorized scope
• Review authentication logs for users making requests to a large number of different system IDs

Monitoring Recommendations

• Enable detailed API request logging that captures the system IDs being accessed and the authenticated user making the request
• Set up anomaly detection rules to identify enumeration behavior, such as sequential or randomized access to many different system IDs
• Monitor for unusual access patterns during off-hours or from unexpected geographic locations

How to Mitigate CVE-2026-40077

Immediate Actions Required

• Upgrade Beszel to version 0.18.7 or later immediately
• Review access logs to determine if any unauthorized access may have occurred prior to patching
• Audit user accounts and their associated system access permissions

Patch Information

The vulnerability is fixed in Beszel version 0.18.7. The fix implements proper authorization checks at the affected API endpoints to ensure users can only access systems they are explicitly authorized to view. Patch details are available in the GitHub Release v0.18.7 and the GitHub Security Advisory GHSA-5f5r-95pg-xrpm.

Workarounds

• If immediate patching is not possible, consider restricting network access to the Beszel hub to trusted networks only
• Implement additional network-layer access controls or reverse proxy authentication to limit who can reach the API endpoints
• Temporarily disable untrusted user accounts until the patch can be applied