PT-2026-96102

CVE-2026-94382

Published

2026-09-21

Updated

2026-10-12

Description by

CVSS 3.1

4.2

Medium

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Beszel versions prior to 0.19.0

Description An insecure direct object reference occurs in the 'POST' and 'DELETE' '/api/beszel/user-alerts' endpoints. This allows authenticated users to create or delete alerts for systems they are not authorized to access by providing arbitrary system IDs in the request body. This can lead to the disclosure of target system names and metrics through the resulting notifications.

Recommendations Update Beszel to version 0.19.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products