CVE-2026-46717

{
  "id": "CVE-2026-46717",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T22:16:50.957",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8."
    },
    {
      "lang": "es",
      "value": "Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versión 1.4.0 hasta antes de la versión 2.0.8, el panel de control de Nezha admite dos roles de usuario: RoleAdmin (Rol==0) y RoleMember (Rol==1). Las rutas de notificación POST /API/v1/notification y PATCH /API/v1/notification/:id están conectadas a través de commonHandler en lugar de adminHandler - por lo que un usuario RoleMember puede llamarlas. Estos manejadores Send() sincrónicamente una solicitud HTTP a una URL controlada por el usuario y reflejan el cuerpo completo de la respuesta (sin límite de tamaño) de vuelta al llamador en cualquier respuesta que no sea 2xx. Este problema ha sido parcheado en la versión 2.0.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nezhahq",
          "product": "nezha",
          "versions": [
            {
              "version": ">= 1.4.0, < 2.0.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-13T03:38:02.540135Z",
          "id": "CVE-2026-46717",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-w4g9-mxgg-j532",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}