Vulnerability · Published Sep 21, 2026 · Assigned by VulnCheck

CVE-2026-94382Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts

Medium 4.2

In plain English

A medium-severity authorization bypass via user-controlled key in beszel from henrygd. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.3%top 76.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

Affected products (as reported)

Vendor	Product	Versions
henrygd	beszel	0 – before 0.19.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-759g-ch5m-2gch) vendor-advisory
Patch Commit patch
Vulnerable UpsertUserAlerts handler at v0.18.8 technical-description
beszel v0.19.0 Release Notes release-notes
https://github.com/henrygd/beszel product
VulnCheck Advisory: Beszel before 0.19.0 Insecure Direct Object Reference via user-alerts third-party-advisory