CVE-2026-46717

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532
https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versión 1.4.0 hasta antes de la versión 2.0.8, el panel de control de Nezha admite dos roles de usuario: RoleAdmin (Rol==0) y RoleMember (Rol==1). Las rutas de notificación POST /API/v1/notification y PATCH /API/v1/notification/:id están conectadas a través de commonHandler en lugar de adminHandler - por lo que un usuario RoleMember puede llamarlas. Estos manejadores Send() sincrónicamente una solicitud HTTP a una URL controlada por el usuario y reflejan el cuerpo completo de la respuesta (sin límite de tamaño) de vuelta al llamador en cualquier respuesta que no sea 2xx. Este problema ha sido parcheado en la versión 2.0.8.

Information

Published : 2026-06-12 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-46717

Mitre link : CVE-2026-46717

CVE.ORG link : CVE-2026-46717

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-46717", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46717", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-13T03:38:02.540135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 1.4.0, < 2.0.8"}]}]}], "published": "2026-06-12T22:16:50.957", "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "source": "security-advisories@github.com"}, {"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler \u2014 so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versi\u00f3n 1.4.0 hasta antes de la versi\u00f3n 2.0.8, el panel de control de Nezha admite dos roles de usuario: RoleAdmin (Rol==0) y RoleMember (Rol==1). Las rutas de notificaci\u00f3n POST /API/v1/notification y PATCH /API/v1/notification/:id est\u00e1n conectadas a trav\u00e9s de commonHandler en lugar de adminHandler - por lo que un usuario RoleMember puede llamarlas. Estos manejadores Send() sincr\u00f3nicamente una solicitud HTTP a una URL controlada por el usuario y reflejan el cuerpo completo de la respuesta (sin l\u00edmite de tama\u00f1o) de vuelta al llamador en cualquier respuesta que no sea 2xx. Este problema ha sido parcheado en la versi\u00f3n 2.0.8."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}