CVE-2026-53521

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0.

CVSS v3 6.4 MEDIUM

6.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8
https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versión 2.0.14 hasta antes de la versión 2.1.0, PATCH /server/{id} acepta y persiste IDs de ddns_profiles inexistentes para un servidor propiedad de un miembro. Si otro usuario crea posteriormente un perfil DDNS con uno de esos IDs, el worker de DDNS resuelve el ID almacenado y despacha una actualización utilizando la configuración del perfil DDNS del otro usuario en el contexto del servidor del atacante. Este problema ha sido parcheado en la versión 2.1.0.

Information

Published : 2026-06-12 22:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-53521

Mitre link : CVE-2026-53521

CVE.ORG link : CVE-2026-53521

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-53521", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53521", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T15:13:18.031987Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "nezhahq", "product": "nezha", "versions": [{"status": "affected", "version": ">= 2.0.14, < 2.1.0"}]}]}], "published": "2026-06-12T22:16:52.230", "references": [{"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8", "source": "security-advisories@github.com"}, {"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0."}, {"lang": "es", "value": "Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versi\u00f3n 2.0.14 hasta antes de la versi\u00f3n 2.1.0, PATCH /server/{id} acepta y persiste IDs de ddns_profiles inexistentes para un servidor propiedad de un miembro. Si otro usuario crea posteriormente un perfil DDNS con uno de esos IDs, el worker de DDNS resuelve el ID almacenado y despacha una actualizaci\u00f3n utilizando la configuraci\u00f3n del perfil DDNS del otro usuario en el contexto del servidor del atacante. Este problema ha sido parcheado en la versi\u00f3n 2.1.0."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "security-advisories@github.com"}