Information Disclosure Vulnerability in Nezha Product by Nezha HQ
CVE-2026-111386

5.3MEDIUM

Key Information:

Vendor

Nezhahq

Status
Nezha
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111386?

Nezha versions prior to 2.3.15 are susceptible to an information disclosure flaw that allows authenticated users to enumerate server IDs belonging to other tenants. This vulnerability arises from the application's differential responses to requests made to getServerConfig and setServerConfig endpoints. Attackers can exploit this by issuing sequential ID queries, effectively distinguishing between 'permission denied' responses and successful payloads, enabling the mapping of other users' server environments.

Affected Version(s)

nezha 1.7.0 < 2.3.15

nezha 2.3.15

References

https://github.com/nezhahq/nezha/security/advisories/GHSA...
vendor-advisory
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed78...
patch
https://www.vulncheck.com/advisories/nezha-1.7.0-before-2...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tan-JunWei
.