CVE-2026-47124

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.9, any authenticated non-admin member can connect to the server-status WebSocket and receive telemetry for all servers, including servers owned by other users. The normal server list API filters objects by HasPermission, but the WebSocket stream treats the presence of any authenticated user as authorization for the full unfiltered server list. This issue has been patched in version 2.0.9.

• CWE-200

• https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj
• https://github.com/nezhahq/nezha/security/advisories/GHSA-hvv7-hfrh-7gxj

Published

Jun 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47119Agent Zero before version 1.15 contains a stored cross-site …6.1
• CVE-2026-4712Information disclosure in the Widget: Cocoa component. This …7.5
• CVE-2026-47120Nezha Monitoring is a self-hostable, lightweight, servers an…7.1
• CVE-2026-47121Sparkle is a software update framework for macOS. Prior to v…6.1
• CVE-2026-47122Sparkle is a software update framework for macOS. In version…4.2
• CVE-2026-47123FreeScout is a free help desk and shared inbox built with PH…7.5
• CVE-2026-47125Arcane is an interface for managing Docker containers, image…8.8
• CVE-2026-47127Ghostfolio is an open source wealth management software. Pri…6.5
• CVE-2026-47128nono is software that allows users to run AI agents in a zer…6.1
• CVE-2026-47129NextCRM is open-source customer relationship management (CRM…8.1
• CVE-2026-4713Incorrect boundary conditions in the Graphics component. Thi…7.5
• CVE-2026-47130NextCRM is open-source customer relationship management (CRM…7.1