Platform
nodejs
Component
beszel
Fixed in
0.18.8
CVE-2026-40077 describes an authorization bypass vulnerability in Beszel, a server monitoring platform. This flaw allows authenticated users to access API endpoints for any system within the Beszel hub, provided they possess the system's ID. The vulnerability affects versions 0.0.0 through 0.18.6 and has been resolved in version 0.18.7.
An attacker exploiting this vulnerability could gain unauthorized access to sensitive system information and potentially manipulate system configurations within the Beszel environment. While system IDs are random alphanumeric strings and not widely exposed, an attacker could theoretically enumerate valid IDs through API requests. Successful exploitation could lead to data breaches, system misconfigurations, and disruption of monitoring services. The potential blast radius is limited to the systems accessible through the Beszel platform, but the impact on those systems could be significant.
CVE-2026-40077 was publicly disclosed on 2026-04-09. The CVSS score is LOW (3.5), indicating a relatively low probability of exploitation. No public proof-of-concept (PoC) code is currently available. It is not listed on the CISA KEV catalog at the time of this writing.
Exploit Status
EPSS
0.05% (17% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-40077 is to upgrade Beszel to version 0.18.7 or later. If upgrading is not immediately feasible, consider implementing stricter access controls within the Beszel environment to limit user privileges and restrict access to sensitive API endpoints. Review and audit existing user permissions to ensure least privilege principles are enforced. Monitoring API access logs for unusual activity can also help detect potential exploitation attempts.
Update Beszel to version 0.18.7 or higher to mitigate the IDOR vulnerability. This update implements proper access checks to protect the hub API endpoints from unauthorized access.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-40077 is a LOW severity vulnerability in Beszel versions 0.0.0 through 0.18.6 that allows authenticated users to access system data if they know the system ID.
You are affected if you are running Beszel versions 0.0.0 through 0.18.6. Upgrade to version 0.18.7 to resolve the issue.
Upgrade Beszel to version 0.18.7 or later. As a temporary workaround, implement stricter access controls and monitor API access logs.
There are currently no reports of active exploitation, but the vulnerability is publicly known.
Refer to the Beszel project's official communication channels and security advisories for the latest information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.