{"schemaVersion":3,"id":"CVE-2026-111386","aliases":[],"status":"published","duplicateOf":null,"title":"Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig","description":"Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.","dates":{"published":"2026-10-16T01:17:54.995Z","modified":"2026-10-16T13:56:01.330Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0021,"percentile":0.10695,"severity":"low","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-16T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.0021,"percentile":0.10695}],"last30":[{"date":"2026-10-16T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.0021,"percentile":0.10695}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-204","name":"Observable Response Discrepancy","description":"The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/204.html"}],"affected":[{"vendor":"nezhahq","product":"nezha","name":"nezha","label":"nezha","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.7.0, < 2.3.15","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.7.0, < 2.3.15","eol":null,"hubHref":"/vendor/nezhahq/nezha"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw","label":"github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvw","hostname":"github.com","tags":["Vendor Advisory"]},{"url":"https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f","label":"github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f","hostname":"github.com","tags":["Patch"]},{"url":"https://www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfig","label":"www.vulncheck.com/advisories/…","hostname":"www.vulncheck.com","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-16T01:17:54.995Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-16T13:56:01.330Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T21:14:59.127Z","stale":false,"partial":false}}