Medium severity4.3NVD Advisory· Published Oct 16, 2026· Updated Oct 16, 2026

CVE-2026-111386

Description

Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers.

Affected products

Nezhahq/Nezhallm-fuzzy
Range: <2.3.15

Patches

Vulnerability mechanics

References

github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0fnvd
github.com/nezhahq/nezha/security/advisories/GHSA-228w-p4h4-6rvwnvd
www.vulncheck.com/advisories/nezha-1.7.0-before-2.3.15-cross-tenant-server-id-enumeration-via-getserverconfignvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000