---
id: CVE-2026-94382
title: >-
  Beszel before 0.19.0 contains an insecure direct object reference
  vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that
  allows any authenticated user to create or delete alerts on systems they
  cannot access
summary: >-
  Beszel before 0.19.0 contains an insecure direct object reference
  vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that
  allows any authenticated user to create or delete alerts on systems they
  cannot access. Attacker…
severity: medium
cvss: 4.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-639
vendor: henrygd
product: beszel
affected:
  - beszel < 0.19.0
published: '2026-09-21'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T15:17:39.290'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94382'
references:
  - url: 'https://github.com/henrygd/beszel'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/henrygd/beszel/blob/v0.18.8/internal/alerts/alerts_api.go#L19-L80
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/henrygd/beszel/commit/6f92b9396dfbacaf71c20444d175af78e0517409
    label: disclosure@vulncheck.com
  - url: 'https://github.com/henrygd/beszel/releases/tag/v0.19.0'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/beszel-before-0.19.0-insecure-direct-object-reference-via-user-alerts
    label: disclosure@vulncheck.com
  - url: 'https://github.com/henrygd/beszel/security/advisories/GHSA-759g-ch5m-2gch'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T14:12:03.342785Z'
ingestedAt: '2026-09-21T13:37:22.848Z'
---

## Overview

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.