EUVD-2026-36600
GHSA-39g2-8x68-pmx8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Network API exploitable by authenticated members (PR:L); no complexity; scope change reflects cross-tenant DDNS dispatch; no direct confidentiality impact since victim credentials are not returned to the attacker.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0.
AnalysisAI
Incorrect authorization in Nezha Monitoring's DDNS profile subsystem allows an authenticated low-privilege member to pre-populate their server record with nonexistent DDNS profile IDs, then hijack any future victim-owned DDNS profile whose auto-assigned ID collides with a pre-stored value. Affected versions span 2.0.14 through pre-2.1.0 of the self-hosted nezhahq/nezha platform. When the collision occurs, the DDNS worker dispatches DNS updates on behalf of the attacker's server using the victim's DDNS provider credentials and configuration, achieving cross-tenant DNS manipulation and disrupting the victim's legitimate DDNS service. No public exploit identified at time of analysis; vendor-released patch available in version 2.1.0.
Technical ContextAI
Nezha Monitoring (CPE: cpe:2.3:a:nezhahq:nezha:*:*:*:*:*:*:*:*) is a self-hostable Go-based server monitoring and operations tool featuring a DDNS subsystem that periodically resolves stored profile IDs and dispatches DNS update requests to external providers such as Cloudflare or DNSPod. The PATCH /server/{id} REST endpoint accepts a ddns_profiles array without validating that supplied IDs refer to existing, user-accessible profiles before persisting them - a CWE-863 (Incorrect Authorization) failure where the authorization check is absent at the data-binding stage rather than enforced at resolution time. Because profile IDs are likely sequential integers assigned by the ORM at creation, an attacker can stake out future IDs speculatively. When a legitimate user later creates a DDNS profile that receives one of those pre-stored IDs, the DDNS worker's ID-based lookup resolves to the victim's profile object, crossing user trust boundaries - a cross-tenant scope change reflected in the CVSS S:C metric.
RemediationAI
Vendor-released patch: version 2.1.0. Operators should upgrade Nezha Monitoring to 2.1.0 or later; the vendor advisory at https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8 confirms this release resolves the authorization defect. If immediate upgrade is not feasible, restrict the PATCH /server/{id} endpoint at the reverse proxy layer to prevent member-role users from submitting arbitrary ddns_profiles IDs - note this will block legitimate server configuration updates for those users. Alternatively, temporarily disabling the DDNS worker process prevents cross-profile dispatch, at the cost of losing all DDNS update functionality for all users. Operators may also audit existing server records for ddns_profiles values that reference nonexistent profile IDs, which would indicate pre-staging by an attacker. Single-user Nezha deployments with no additional member accounts are not exposed and require only a planned upgrade.
Unauthenticated path traversal in Nezha Monitoring (nezhahq/nezha) before 2.0.13 allows remote attackers to read arbitra
Cross-tenant session hijacking in Nezha Monitoring (v1.14.13-1.14.14 and v2.0.0-2.0.9) lets any authenticated low-privil
Nezha Monitoring versions prior to 2.2.5 expose stored third-party API credentials in plaintext through two listing API
Host header injection in Nezha Monitoring versions 1.0.0 through 2.2.0 allows unauthenticated remote attackers to redire
Unbounded WebSocket stream allocation in Nezha Monitoring versions 1.0.0 through 2.1.x allows any authenticated dashboar
Nezha Monitoring versions 2.0.14 through 2.1.0 (exclusive) allows any authenticated user to exploit the NAT-based Host c
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today