CVE-2026-48119

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm
https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web, y de O&M. Desde la versión 0.20.0 hasta antes de la versión 2.0.12, los agentes autenticados pueden falsificar los resultados del monitoreo de servicios para los servicios de otros usuarios. Este problema ha sido parcheado en la versión 2.0.12.

Information

Published : 2026-06-12 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-48119

Mitre link : CVE-2026-48119

CVE.ORG link : CVE-2026-48119

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-48119", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48119", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T17:05:16.195138Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 0.20.0, < 2.0.12"}]}]}], "published": "2026-06-12T22:16:51.540", "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm", "source": "security-advisories@github.com"}, {"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-4g6j-g789-rghm", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable, ligera, de monitoreo de servidores y sitios web, y de O&M. Desde la versi\u00f3n 0.20.0 hasta antes de la versi\u00f3n 2.0.12, los agentes autenticados pueden falsificar los resultados del monitoreo de servicios para los servicios de otros usuarios. Este problema ha sido parcheado en la versi\u00f3n 2.0.12."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}