EUVD-2026-21047
GHSA-5f5r-95pg-xrpm
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.
AnalysisAI
Beszel prior to 0.18.7 allows authenticated users to access monitoring data for any system without authorization checks, enabling information disclosure of system details and container metadata through ID enumeration. An authenticated attacker can bypass access controls on API endpoints by supplying a valid system ID (15 character alphanumeric) and optionally a container ID (12 digit hexadecimal), potentially discovering sensitive monitoring information across all systems in the platform despite not having legitimate access.
Technical ContextAI
Beszel is a server monitoring platform that uses system IDs and container IDs to manage access to monitoring data. The vulnerability stems from CWE-184 (Incomplete List of Disallowed Inputs), where API endpoints accept user-supplied identifiers without verifying that the authenticated user has authorization to access the specified resource. System IDs are generated as random 15-character alphanumeric strings and container IDs are 12-digit hexadecimal values. While these identifiers have high entropy, the lack of authorization checks on endpoint handlers creates a privilege escalation pathway where any authenticated user can perform enumeration attacks to discover valid IDs and access monitoring information they should not be able to view. The vulnerability affects the Beszel hub component (CPE: cpe:2.3:a:henrygd:beszel:*:*:*:*:*:*:*:*) across all versions before 0.18.7.
RemediationAI
Vendor-released patch: Beszel 0.18.7. Upgrade Beszel to version 0.18.7 or later, which includes authorization checks on API endpoints to verify that authenticated users have explicit access to requested systems before returning monitoring data. The patch is available at https://github.com/henrygd/beszel/releases/tag/v0.18.7. Until patching is possible, network-level controls such as restricting API access to trusted IP ranges or requiring additional authentication mechanisms can reduce the attack surface, though these are not substitutes for the upstream fix.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today