---
id: CVE-2026-111386
title: >-
  Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via
  getServerConfig
summary: >-
  Nezha from 1.7.0 before 2.3.15 contains an information disclosure
  vulnerability that allows authenticated members to enumerate other tenants'
  server IDs through differential responses. Attackers can sweep sequential IDs
  against getServer…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-204
vendor: nezhahq
product: nezha
affected:
  - nezha >= 1.7.0 < 2.3.15
published: '2026-10-16'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T01:17:54.995Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111386'
references:
  - url: 'https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw'
    label: GitHub Security Advisory (GHSA-228w-p4h4-6rvw)
  - url: >-
      https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfig
    label: >-
      VulnCheck Advisory: Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID
      Enumeration via getServerConfig
tags:
  - cve.org
ingestedAt: '2026-10-16T01:55:57.990Z'
---

## Overview

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

## Affected

- `nezha >= 1.7.0 < 2.3.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.