CVE-2026-53521

{
  "id": "CVE-2026-53521",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-12T22:16:52.230",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0."
    },
    {
      "lang": "es",
      "value": "Nezha Monitoring es una herramienta autoalojable y ligera para el monitoreo de servidores y sitios web, y para O&M. Desde la versión 2.0.14 hasta antes de la versión 2.1.0, PATCH /server/{id} acepta y persiste IDs de ddns_profiles inexistentes para un servidor propiedad de un miembro. Si otro usuario crea posteriormente un perfil DDNS con uno de esos IDs, el worker de DDNS resuelve el ID almacenado y despacha una actualización utilizando la configuración del perfil DDNS del otro usuario en el contexto del servidor del atacante. Este problema ha sido parcheado en la versión 2.1.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "nezhahq",
          "product": "nezha",
          "versions": [
            {
              "version": ">= 2.0.14, < 2.1.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
          "baseScore": 6.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-15T15:13:18.031987Z",
          "id": "CVE-2026-53521",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}