CVE-2026-111386

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-111386

The Nezha platform, versions 1.7.0 before 2.3.15 , is vulnerable to an information disclosure flaw. Authenticated members can perform Cross-Tenant Server-ID Enumeration by leveraging differential responses from the getServerConfig and setServerConfig functions. By sweeping sequential IDs, an atta...

CVE-2026-111386 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

EUVD-2026-102567

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-111386

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-111386 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-111386 Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

PT-2026-115392

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

CVE-2026-111386: Observable Response Discrepancy

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denie...

Nezhahq Nezha side-channel information leakage vulnerability

Versions of Nezhahq Nezha from 1.7.0 to 2.3.15 had a vulnerability related to side-channel information leakage. This vulnerability stemmed from improper handling of differences in responses to the getServerConfig and setServerConfig interfaces. Certified members can distinguish between...