{"cve":"CVE-2026-47124","nvd":{"published":"2026-06-12T22:16:51.250","modified":"2026-10-25T23:10:00.167","status":"Deferred","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-200"],"references":["https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj","https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj"],"products":[],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-47124","score":0.0027,"percentile":0.19032,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-hvv7-hfrh-7gxj","url":"https://osv.dev/vulnerability/GHSA-hvv7-hfrh-7gxj","summary":"Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members","modified":"2026-06-26T21:45:24.293701063Z","packages":[{"ecosystem":"Go","name":"github.com/nezhahq/nezha","purl":"pkg:golang/github.com/nezhahq/nezha","ranges":[">=1.4.0 <1.14.15-0.20260517034128-05e5da253519"],"fixed":["1.14.15-0.20260517034128-05e5da253519"]}]},{"id":"GO-2026-5439","url":"https://osv.dev/vulnerability/GO-2026-5439","summary":"Nezha Monitoring: Nezha WebSocket server stream discloses cross-tenant server telemetry to authenticated members in github.com/nezhahq/nezha","modified":"2026-06-25T23:01:10.040268497Z","packages":[{"ecosystem":"Go","name":"github.com/nezhahq/nezha","purl":"pkg:golang/github.com/nezhahq/nezha","ranges":[">=1.4.0 <1.14.15-0.20260517034128-05e5da253519"],"fixed":["1.14.15-0.20260517034128-05e5da253519"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}