CVE-2026-62283 Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/iostream.go to their creating user, and GET /ws/terminal/:id and GET...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the lack of ownership verification in the terminalStream and fmStream processes. An attacker can gain unauthorized interactive shell access or full file-manager control on the target server by obtaining a...

PT-2026-79458

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 1.14.13 through 1.14.14 Nezha Monitoring versions 2.0.0 through 2.0.9 Description Nezha Monitoring fails to bind stream identifiers created by the CreateStream function in service/rpc/io stream.go to the user who...