{"items":[{"id":"NVI-00017473","kind":"vulnerability","title":"Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-99gv-2m7h-3hh9","CVE-2026-46716"],"plain_summary":"GitHub lists this reviewed advisory for github.com/nezhahq/nezha. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-067b1270eea38382400ae92549fcfb5b"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T21:28:23.000Z","value":"9.9 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-067b1270eea38382400ae92549fcfb5b"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-067b1270eea38382400ae92549fcfb5b","url":"https://github.com/advisories/GHSA-99gv-2m7h-3hh9","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-99gv-2m7h-3hh9","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:04.022Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-067b1270eea38382400ae92549fcfb5b"],"technology":"github.com/nezhahq/nezha","known_exclusions":[],"conditions_summary":"## Summary\n\n`nezha`'s dashboard supports two user roles: `RoleAdmin` (Role==0) and `RoleMember` (Role==1). The cron routes `POST /api/v1/cron` and `PATCH /api/v1/cron/:id` are wired through `commonHandler` (any authenticated user) rather than `adminHandler`, and the per-server permission check on cron creation has a vacuous-true bypass.\n\nA `RoleMember` user can create a scheduled cron task with `Cover=CronCoverAll, Servers=[]` and an arbitrary `Command`. At every tick of the scheduler, the dashboard pushes that command to **every server in the global `ServerShared` map** — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook.\n\nNet effect: any `RoleMember` (including a self-bound OAuth2 user, if the dashboard has OAuth2 configured) gets pre-validated cross-tenant RCE on every nezha-monitored host in the deployment.\n\n## Affected versions\n\nCommit `50dc8e660326b9f22990898142c58b7a5312b42a` and earlier on `master`.\n\n## The auth gate\n\n```go\n// cmd/dashboard/controller/controller.go:131-135\nauth.GET(\"/cron\", listH","public_affected_ranges":[">= 1.4.0, < 1.14.15-0.20260517022419-d7526351cf97"]}],"null_published_at":"2026-11-05T19:10:21.393Z","source_updated_at":"2026-06-26T21:28:23.000Z","source_disclosed_at":"2026-05-23T00:17:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:04.022Z"}],"next_cursor":null,"snapshot_revision":"42594"}