---
id: "CVE-2026-111386"
kind: "vulnerability"
aliases: ["CVE-2026-111386"]
title: "Nezha: authenticated members can enumerate other tenants' server IDs"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["monitoring", "nezha", "other", "self-hosted"]
not_affected_if: ["default-config", "single-user"]
published_at: "2026-10-16T03:18:06+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:28:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111386", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Nezha: authenticated members can enumerate other tenants' server IDs

Nezha versions from 1.7.0 before 2.3.15 leak which server IDs belong to other users through differing responses from the server config endpoints. An authenticated member can sweep sequential IDs and tell 'permission denied' apart from success to map other users' servers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Nezha version; `unknown` for the exact command, the sources do not say how it is deployed.
- Confirm whether the dashboard has multiple member accounts that share one instance.

## Fix

- Upgrade Nezha to `2.3.15` or later.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111386

## From the sources

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_