CVE-2026-46717: Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification

Vulnerability summary

CVE-2026-46717 is a high (CVSS 7.7) Incorrect Authorization vulnerability in nezhahq nezha. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.7% of scored vulnerabilities.

Timeline

1. 12-06-2026
   PublishedVulnerability first disclosed.
2. 13-06-2026
   Last modifiedVulnerability information updated.

Description

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, nezha's dashboard supports two user roles: RoleAdmin (Role==0) and RoleMember (Role==1). The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are wired through commonHandler rather than adminHandler — so a RoleMember user can call them. These handlers synchronously Send() an HTTP request to a user-controlled URL and reflect the entire response body (no size limit) back to the caller on any non-2xx response. This issue has been patched in version 2.0.8.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.