CVE-2026-94382 Overview
CVE-2026-94382 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Beszel, a lightweight server monitoring hub. The flaw resides in the POST and DELETE /api/beszel/user-alerts handlers in versions before 0.19.0. Any authenticated user can supply arbitrary system IDs in the request body to create or delete alert rules on systems they are not authorized to access. Once an alert is registered, the attacker receives notifications that disclose target system names and metric values. The vulnerability was patched in Beszel v0.19.0.
Critical Impact
Authenticated Beszel users can enumerate and monitor arbitrary systems by registering alerts against system IDs they do not own, leading to disclosure of hostnames and performance telemetry.
Affected Products
- Beszel versions prior to 0.19.0
- Beszel hub /api/beszel/user-alerts API endpoint
- Deployments exposing the Beszel hub to multiple tenant users
Discovery Timeline
- 2026-09-21 - CVE-2026-94382 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-94382
Vulnerability Analysis
Beszel exposes a REST endpoint at /api/beszel/user-alerts for managing per-user alert rules on monitored systems. The handler in internal/alerts/alerts_api.go accepts a system identifier from the request body and creates or removes an alert without verifying whether the caller has permission to view that system. Because Beszel treats an authenticated session as sufficient authorization, the handler operates directly on the supplied object reference. An attacker with any low-privilege account can iterate through system IDs and attach alert rules to hosts belonging to other users. When alert thresholds trip, the notification payload includes the target system name and metric data, effectively converting the alerting subsystem into an information disclosure channel.
Root Cause
The root cause is missing authorization enforcement between the authenticated principal and the referenced system record. The API validates authentication but does not verify ownership or read access on the target system ID before mutating the alerts collection [CWE-639].
Attack Vector
Exploitation requires a valid, low-privilege account on the Beszel hub and network reachability to the API. The attacker sends a crafted POST request to /api/beszel/user-alerts containing a system identifier that belongs to another tenant, then waits for alert notifications that reveal system names and metric thresholds. DELETE requests against the same endpoint can also remove alerts belonging to other users, degrading their monitoring coverage.
// Security patch in internal/alerts/alerts_api.go - fix(hub): user alerts idor
"slices"
"strings"
+ "github.com/henrygd/beszel/internal/hub/utils"
"github.com/pocketbase/dbx"
"github.com/pocketbase/pocketbase/core"
)
Source: GitHub Commit 6f92b93. The patch introduces a hub utilities import used to enforce ownership checks before the alert create and delete handlers mutate state.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-94382
Indicators of Compromise
- POST or DELETE requests to /api/beszel/user-alerts where the authenticated user does not own the referenced system ID.
- Sequential or enumerated system identifiers appearing in alert-creation request bodies from a single account.
- Unexpected alert notifications delivered to users who were not previously subscribed to a given host.
Detection Strategies
- Review Beszel hub access logs for repeated user-alerts API calls from non-administrative accounts targeting many distinct system IDs.
- Correlate PocketBase audit records for the alerts collection against the ownership graph of monitored systems to surface cross-tenant writes.
- Alert on any low-privilege account that creates alerts for more than a small number of systems in a short window.
Monitoring Recommendations
- Enable verbose request logging on the Beszel hub and forward events to a centralized log platform for retention and query.
- Track the volume and distribution of user-alerts writes per account and baseline normal behavior.
- Monitor outbound notification channels (email, webhook, push) for delivery of alerts referencing systems outside a recipient's authorized scope.
How to Mitigate CVE-2026-94382
Immediate Actions Required
- Upgrade Beszel to version 0.19.0 or later, which ships the authorization fix in the user-alerts handlers.
- Audit the alerts collection in PocketBase and remove any entries where the owning user lacks access to the referenced system.
- Rotate or disable low-trust accounts that show anomalous user-alerts activity pending investigation.
Patch Information
The fix is included in Beszel Release v0.19.0 and implemented by GitHub Commit 6f92b93. See the GitHub Security Advisory GHSA-759g-ch5m-2gch and the VulnCheck Advisory for Beszel for coordinated disclosure details.
Workarounds
- Restrict network access to the Beszel hub to trusted operators until the upgrade is applied.
- Limit account creation on the hub and disable self-registration to reduce the pool of authenticated attackers.
- Place the /api/beszel/user-alerts endpoint behind a reverse-proxy access control that validates account-to-system ownership where feasible.
# Upgrade Beszel hub to the patched release
docker pull henrygd/beszel:0.19.0
docker stop beszel && docker rm beszel
docker run -d --name beszel -p 8090:8090 \
-v /opt/beszel/data:/beszel_data \
henrygd/beszel:0.19.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
