CVE-2026-53521
published 2026-06-12CVE-2026-53521: Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id}…
PriorityP336medium6.4CVSS 3.1
AVNACLPRLUINSCCNILAL
EPSS
0.23%
13.4th percentile
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 2.0.14 to before version 2.1.0, PATCH /server/{id} accepts and persists nonexistent ddns_profiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This issue has been patched in version 2.1.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | nezhahq_nezha | >= 2.0.14 < 2.1.0 | 2.1.0 |
| nezhahq | nezha | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
ghsa·2026-06-26
CVE-2026-53521 [MEDIUM] CWE-863 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context
## Summary
`PATCH /server/{id}` accepts and persists nonexistent `ddns_profiles` IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server.
This is a second-order authorization bypass: direct binding to an existing foreign DDNS profile is correctly denied, but an unresolved future ID can be stored first and later becomes a live cross-user reference.
## Affected versions
Confirmed on:
- Nezha `v2.0.14`
- Commit: `8b5e382fe217107c7b777ea9c6b4bc3d2e156202`
The exact affected version ra
VulDB
nezhahq nezha up to 2.0.x Configuration authorization (GHSA-39g2-8x68-pmx8)
vuldb·2026-06-13·CVSS 6.4
CVE-2026-53521 [MEDIUM] nezhahq nezha up to 2.0.x Configuration authorization (GHSA-39g2-8x68-pmx8)
A vulnerability, which was classified as problematic, has been found in nezhahq nezha up to 2.0.x. Affected by this vulnerability is an unknown functionality of the component Configuration Handler. This manipulation causes incorrect authorization.
This vulnerability is tracked as CVE-2026-53521. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-12
Published