CVE-2026-111386Medium· 4.3▾ SunlitNezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServer…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.
nezha >= 1.7.0 < 2.3.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111387Medium· 6.5Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
CVE-2026-111385Medium· 4.8Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
CVE-2026-111383Medium· 6.5Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
CVE-2026-111384Medium· 6.5Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
CVE-2026-100394Medium· 6.5Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool
CVE-2026-105112Medium· 5.3Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem