Nezha Dashboard CVE-2026-105113

Requires a valid authenticated non-admin member account on the Nezha Dashboard and the ability to reach the notification API; the attacker issues four notification API calls to hit the nil-map panic path. The core limiting factor is authentication (PR:L) - the attacker must already possess credentials, so risk is highest on instances with open/self-service registration or many low-trust users, and lowest on tightly controlled single-admin deployments. No user interaction or non-default configuration is required beyond having a reachable, running alerting subsystem on an affected version (1.8.0 before 2.3.13).

This is a genuine but bounded availability risk, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 7.1 (High) score are driven entirely by availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N) - consistent with the CWE-667 improper-locking root cause. The decisive mitigating signal is PR:L: exploitation requires a valid authenticated non-admin account, so this is not internet-wide drive-by attackable; the realistic threat model is a malicious or compromised low-privilege member, or an instance with open/self-service registration. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active exploitation or weaponization. The signals are internally consistent (no conflicts between vector and description), but the 'Information Disclosure' tag directly contradicts the vector (VC:N) and the DoS description - it appears mislabeled and should not be used to prioritize this as a data-exposure issue.

A low-privilege authenticated member (or anyone who can self-register on an open instance) sends four crafted notification API calls that drive the alerting code down a nil-map panic path where a non-deferred mutex is never unlocked, permanently deadlocking the alerting subsystem. The attacker then floods the now-blocking endpoints with requests, causing unbounded memory growth and denial of service. No public exploit code was identified at time of analysis.