{"id":"CVE-2026-111386","kind":"vulnerability","aliases":["CVE-2026-111386"],"related":[],"title":"Nezha: authenticated members can enumerate other tenants' server IDs","description":"Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.","summary":"Nezha versions from 1.7.0 before 2.3.15 leak which server IDs belong to other users through differing responses from the server config endpoints. An authenticated member can sweep sequential IDs and tell 'permission denied' apart from success to map other users' servers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["monitoring","nezha","other","self-hosted"],"not_affected_if":["default-config","single-user"],"how_to_check":"- Check the installed Nezha version; `unknown` for the exact command, the sources do not say how it is deployed.\n- Confirm whether the dashboard has multiple member accounts that share one instance.","fix":"- Upgrade Nezha to `2.3.15` or later.","status":"open","published_at":"2026-10-16T03:18:06+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:28:42+00:00","updated_at":"2026-10-25T04:28:42+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T04:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Nezha to `2.3.15` or later.","reach":"internet","title":"Nezha: authenticated members can enumerate other tenants' server IDs","impact":"low","summary":"Nezha versions from 1.7.0 before 2.3.15 leak which server IDs belong to other users through differing responses from the server config endpoints. An authenticated member can sweep sequential IDs and tell 'permission denied' apart from success to map other users' servers.","category":"other","nicknames":[],"who_cares":["self-hosted","nezha","monitoring"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker maps other tenants' server IDs, leaking which servers exist.","analyst_note":"Confirm the fixed version and whether a patch or advisory page exists beyond the NVD entry; the sources do not give a how-to-check.","how_to_check":"- Check the installed Nezha version; `unknown` for the exact command, the sources do not say how it is deployed.\n- Confirm whether the dashboard has multiple member accounts that share one instance.","needs_analyst":true,"not_affected_if":["single-user","default-config"],"who_is_affected":"Teams running a multi-user Nezha dashboard where members can log in and each member should only see their own servers. A single-user instance has no other tenants to enumerate, so the exposure is limited there.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3338,"output_tokens":507,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111386':12A,15A '-2026':11A,14A '1.7.0':25B,65C '2.3.15':27B,67C 'allow':74C 'apart':55B 'attack':86C 'authent':2A,45B,75C 'belong':32B 'config':42B 'contain':68C 'cve':10A,13A 'deni':54B,97C 'differ':37B 'differenti':84C 'disclosur':71C 'distinguish':95C 'endpoint':43B 'enumer':5A,78C 'getserverconfig':92C 'host':21B 'id':9A,31B,50B,82C,90C 'inform':70C 'leak':28B 'map':59B,102C 'member':3A,46B,76C 'monitor':16B 'nezha':1A,17B,22B,63C 'payload':100C 'permiss':53B,96C 'respons':38B,85C 'self':20B 'self-host':19B 'sequenti':49B,89C 'server':8A,30B,41B,62B,81C,105C 'setserverconfig':94C 'success':57B,99C 'sweep':48B,88C 'tell':52B 'tenant':7A,80C 'user':35B,61B,104C 'version':23B 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":"Teams running a multi-user Nezha dashboard where members can log in and each member should only see their own servers. A single-user instance has no other tenants to enumerate, so the exposure is limited there.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111386","severity":null,"published_at":"2026-10-16T03:18:06+00:00","modified_at":"2026-10-16T14:17:23+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}