Description

Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary system IDs in the request body to register alert rules and receive notifications disclosing target system names and metrics.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-21T14:17:30.170Z",
  "pubdate": "2026-09-21T14:17:30.170Z",
  "executiveSummary": "Beszel versions prior to 0.19.0 are susceptible to an Insecure Direct Object Reference (IDOR) vulnerability within the /api/beszel/user-alerts endpoint.\nThis vulnerability exists due to insufficient authorization checks when handling POST and DELETE requests directed at user alert configurations.\nThe flaw permits any authenticated user to interact with alert rules associated with systems they are not authorized to access.\nBy manipulating the system ID within the request body, a malicious actor can register unauthorized alert triggers or remove existing monitoring configurations.\nSuccessful exploitation results in the unauthorized disclosure of sensitive telemetry data, including target system names and internal performance metrics.\nThis presents a significant security risk, as it allows unauthorized parties to gain visibility into the monitoring infrastructure and potentially disrupt alert notifications or reconnaissance-based activities.\nAuthentication is required to perform the attack; however, no administrative privileges are necessary to exploit this vulnerability.",
  "technicalDetails": "The vulnerability resides in the backend API handlers responsible for user-defined alert management, specifically within the /api/beszel/user-alerts endpoint.\nThe root cause is a failure to implement server-side access control validation when processing requests to create or delete alert rules. The application logic assumes that the system ID provided in the request body is implicitly authorized for the authenticated user session.\nWhen a POST or DELETE request is transmitted to /api/beszel/user-alerts, the application does not verify if the user possesses the appropriate permissions to modify alerts for the specified target system ID.\nAn attacker can exploit this by intercepting a legitimate request and replacing the legitimate system ID with an arbitrary identifier belonging to a system not associated with their account.\nThe attack flow proceeds as follows: 1) The attacker authenticates to the Beszel platform using a valid user account. 2) The attacker crafts an HTTP request (POST or DELETE) targeting the /api/beszel/user-alerts endpoint. 3) The attacker modifies the 'system_id' parameter within the JSON payload to target a system they wish to monitor or disrupt. 4) The server processes the request without validating the user's relationship with the target system. 5) For a POST request, the attacker successfully registers an alert, which will subsequently send notifications to the attacker's configured endpoints. 6) For a DELETE request, the attacker successfully removes alert rules from a system they should not have access to.\nPost-exploitation impact is severe, as the attacker can gain persistent unauthorized access to telemetry updates regarding systems outside their privilege scope. By receiving notifications, the attacker can conduct passive reconnaissance, identifying system performance trends, uptime statuses, and internal naming conventions. Furthermore, the ability to delete alerts allows an attacker to sabotage the monitoring environment, effectively blinding administrators to critical system failures or performance issues, which may facilitate further malicious activity without immediate detection."
}