3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40077

CVE-2026-40077: Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40077

CVE-2026-40077:

3.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/henrygd/beszel	go	<= 0.18.6	0.18.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an Insecure Direct Object Reference (IDOR) affecting multiple API endpoints in the Beszel hub. The root cause was the failure to perform authorization checks in custom API route handlers. Specifically, the containerRequestHandler, getSystemdInfo, and refreshSmartData functions in internal/hub/api.go would retrieve a system object based on a system ID provided in the URL query parameters. However, these functions never verified if the authenticated user making the request was actually associated with the requested system. This allowed any authenticated user to perform actions (like refreshing SMART data) or access sensitive information (like container logs and systemd service details) for any system on the platform, provided they could guess the 15-character alphanumeric system ID. The patch, identified in commit ba10da1b9f13455f2879336445102a45eb6cb07b, rectifies this by introducing an authorization check. A new method, system.HasUser(), was created to verify if the authenticated user's ID is present in the list of users for the target system. This check is now performed immediately after fetching the system object in each of the vulnerable functions, thus closing the security hole.

Vulnerable functions

Hub.containerRequestHandler

internal/hub/api.go

This function, which handles container-related API requests, was vulnerable to an Insecure Direct Object Reference (IDOR). It accepted a 'system' ID from a URL parameter and retrieved the corresponding system's data without verifying if the authenticated user was authorized to access it. The patch added the `!system.HasUser(e.App, e.Auth.Id)` check to ensure the user is associated with the system before proceeding.

Hub.getSystemdInfo

internal/hub/api.go

This function was vulnerable to IDOR because it retrieved systemd service information based on a user-supplied 'system' ID without checking if the user was authorized for that system. An attacker could access systemd details of any system by guessing its ID. The fix introduced the `!system.HasUser(e.App, e.Auth.Id)` check to validate user permissions.

Hub.refreshSmartData

internal/hub/api.go

This function, responsible for refreshing S.M.A.R.T. data, was vulnerable to IDOR. It took a 'system' ID from the request but did not validate if the authenticated user had permission to access that system. This allowed any authenticated user to trigger a potentially resource-intensive operation on any system. The vulnerability was patched by adding the `!system.HasUser(e.App, e.Auth.Id)` authorization check.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.