PatchSiren cyber security CVE debrief

CVE-2026-46717 nezhahq CVE debrief

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response.

Vendor: nezhahq
Product: nezha
CVSS: HIGH 7.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-12
Original CVE updated: 2026-06-13
Advisory published: 2026-06-12
Advisory updated: 2026-06-13

Who should care

Users of Nezha Monitoring versions 1.4.0 to 2.0.7 should be aware of this vulnerability.

Technical summary

The vulnerability has a CVSS score of 7.7 and is classified as HIGH. It allows a RoleMember user to send an HTTP request to a user-controlled URL and reflect the entire response body back to the caller on any non-2xx response.

Defensive priority

HIGH

Recommended defensive actions

Upgrade to Nezha Monitoring version 2.0.8 or later.
Restrict access to the notification routes to only admin users.

Evidence notes

The vulnerability was patched in version 2.0.8.

Official resources

CVE-2026-46717 was published on 2026-06-12T22:16:50.957Z and modified on 2026-06-13T04:17:27.870Z.