https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 05:40:49 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-47120 <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users&#39; cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been patched in version 2.0.8.</p> <p>Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&amp;M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users&#39; cron tasks via AlertRule.FailTriggerTasks (no ownership check). This issue has been patched in version 2.0.8.</p> https://db.gcve.eu/vuln/fkie_cve-2026-47120 https://db.gcve.eu/vuln/ghsa-rxf6-wjh4-jfj6 <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>## Summary</p> <p>`createAlertRule` and `createService` (and their `update*` siblings) accept `FailTriggerTasks []uint64` and `RecoverTriggerTasks []uint64` — IDs of cron tasks to fire when the alert/service trips. The validation function only validates the alert&#39;s `Rules.Ignore` server map; it never checks that the cron task IDs in `FailTriggerTasks` / `RecoverTriggerTasks` belong to the caller.</p> <p>When the alert fires, `singleton.CronShared.SendTriggerTasks(taskIDs, triggerServer)` (`service/singleton/crontask.go:113-127`) looks up those task IDs in the global cron registry and executes them via `CronTrigger`. For non-`AlertTrigger` cover modes, `CronTrigger` fans the command out to every server in `ServerShared.Range` with no ownership check.</p> <p>Net effect: a `RoleMember` can attach their alert rule (or service monitor) to **another user&#39;s** cron task ID — including admin&#39;s crons. When the alert trips, the admin&#39;s cron command runs across every server (or every server in its allow/deny list).</p> <p>This is the same fanout/auth-bypass class as `NEZHA-002` (cron creation), but reachable by a different code path: even if `/cron` writes are restricted to admin, this `/alert-rule` and `/service` writes are member-reachable and let a member invoke pre-existing admin crons.</p> <p>## Affected versions</p> <p>Commit `50dc8e660326b9f22990898142c58b7a5312b42a` and earlier on `master`.</p> <p>## Reachability chain</p> <p>1. `POST /api/v1/alert-rule` (or `POST /api/v1/service`) is `commonHandler`-gated — any authenticated…</p> <p><strong>Affected:</strong> Go: github.com/nezhahq/nezha</p> <p>## Summary</p> <p>`createAlertRule` and `createService` (and their `update*` siblings) accept `FailTriggerTasks []uint64` and `RecoverTriggerTasks []uint64` — IDs of cron tasks to fire when the alert/service trips. The validation function only validates the alert&#39;s `Rules.Ignore` server map; it never checks that the cron task IDs in `FailTriggerTasks` / `RecoverTriggerTasks` belong to the caller.</p> <p>When the alert fires, `singleton.CronShared.SendTriggerTasks(taskIDs, triggerServer)` (`service/singleton/crontask.go:113-127`) looks up those task IDs in the global cron registry and executes them via `CronTrigger`. For non-`AlertTrigger` cover modes, `CronTrigger` fans the command out to every server in `ServerShared.Range` with no ownership check.</p> <p>Net effect: a `RoleMember` can attach their alert rule (or service monitor) to **another user&#39;s** cron task ID — including admin&#39;s crons. When the alert trips, the admin&#39;s cron command runs across every server (or every server in its allow/deny list).</p> <p>This is the same fanout/auth-bypass class as `NEZHA-002` (cron creation), but reachable by a different code path: even if `/cron` writes are restricted to admin, this `/alert-rule` and `/service` writes are member-reachable and let a member invoke pre-existing admin crons.</p> <p>## Affected versions</p> <p>Commit `50dc8e660326b9f22990898142c58b7a5312b42a` and earlier on `master`.</p> <p>## Reachability chain</p> <p>1. `POST /api/v1/alert-rule` (or `POST /api/v1/service`) is `commonHandler`-gated — any authenticated…</p> https://db.gcve.eu/vuln/ghsa-rxf6-wjh4-jfj6