CVE-2026-94382

Name of the Vulnerable Software and Affected Versions Beszel versions prior to 0.19.0

Description An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authorized to access by providing arbitrary system IDs in the request body. This can lead to the disclosure of target system names and metrics through the resulting notifications.

Recommendations Update Beszel to version 0.19.0 or later.