{"items":[{"id":"NVI-00017577","kind":"vulnerability","title":"Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-w4g9-mxgg-j532","CVE-2026-46717"],"plain_summary":"GitHub lists this reviewed advisory for github.com/nezhahq/nezha. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-266061b2a3ae9c332662f47761aaee64"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-26T21:28:28.000Z","value":"8.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-266061b2a3ae9c332662f47761aaee64"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-266061b2a3ae9c332662f47761aaee64","url":"https://github.com/advisories/GHSA-w4g9-mxgg-j532","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-w4g9-mxgg-j532","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T19:05:04.022Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-266061b2a3ae9c332662f47761aaee64"],"technology":"github.com/nezhahq/nezha","known_exclusions":[],"conditions_summary":"## Summary\n\nnezha's dashboard supports two user roles: `RoleAdmin` (Role==0) and `RoleMember` (Role==1). The notification routes `POST /api/v1/notification` and `PATCH /api/v1/notification/:id` are wired through `commonHandler` rather than `adminHandler` — so a `RoleMember` user can call them. These handlers synchronously `Send()` an HTTP request to a user-controlled URL and reflect the *entire* response body (no size limit) back to the caller on any non-2xx response.\n\nNet effect: a low-privilege `RoleMember` can read intranet HTTP response bodies via the dashboard's hub.\n\n## Affected versions\n\nCommit `50dc8e660326b9f22990898142c58b7a5312b42a` and earlier on `master`.\n\n## Reachability chain\n\n```\ncmd/dashboard/controller/controller.go:121-122\n    auth.GET(\"/notification\", listHandler(listNotification))\n    auth.POST(\"/notification\", commonHandler(createNotification))   // <-- commonHandler, not adminHandler\n```\n\nFor comparison, `/user` routes ARE gated by `adminHandler`:\n\n```\nauth.GET(\"/user\", adminHandler(listUser))\nauth.POST(\"/user\", adminHandler(createUser))\nauth.POST(\"/batch-delete/user\", adminHandler(batchDeleteUser))\n```\n\n`adminHandler` (controller.go:220-236) explicitly enfor","public_affected_ranges":[">= 1.4.0, < 1.14.15-0.20260517022419-d06d539d34c1"]}],"null_published_at":"2026-11-05T19:10:21.421Z","source_updated_at":"2026-06-26T21:28:28.000Z","source_disclosed_at":"2026-05-23T00:08:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T19:05:04.022Z"}],"next_cursor":null,"snapshot_revision":"42594"}