CVE-2026-40077: 
NixOS vulnerability analysis and mitigation

CVE-2026-40077 is an Insecure Direct Object Reference (IDOR) / authorization bypass vulnerability in Beszel, an open-source server monitoring platform. Prior to version 0.18.7, several API endpoints in the Beszel hub accept a user-supplied system ID without verifying that the authenticated user has permission to access that system, allowing any authenticated user to access monitoring data for systems they are not assigned to. The vulnerability affects all Beszel versions up to and including 0.18.6, and was disclosed on April 9, 2026. It carries a CVSS v3.1 base score of 3.1–3.5 (Low), reflecting the high attack complexity due to the need to enumerate random IDs (GitHub Advisory, Red Hat CVE).

The root cause is an incomplete authorization check (CWE-184: Incomplete List of Disallowed Inputs) in internal/hub/api.go (lines 283–361). The containerRequestHandler function, as well as getSystemdInfo and refreshSmartData, retrieve a system by its user-supplied ID via h.sm.GetSystem(systemID) but never verify that the authenticated user (e.Auth.Id) is a member of that system. In contrast, the standard PocketBase collection API correctly enforces membership rules (users.id ?= @request.auth.id), but these rules are not applied to the custom routes registered on apiAuth. The affected endpoints are GET /api/beszel/containers/logs, GET /api/beszel/containers/info, GET /api/beszel/systemd/info, and POST /api/beszel/smart/refresh, all of which accept a system query parameter. Exploitation requires knowledge of a valid 15-character alphanumeric system ID (and additionally a 12-digit hex container ID for container endpoints), which can theoretically be enumerated via the web API (GitHub Advisory).

A successfully exploiting authenticated attacker can read container logs (potentially containing sensitive application data), retrieve Docker container metadata via the engine API, query systemd unit properties and service status, and trigger SMART data refreshes on any system in the Beszel hub — regardless of their assigned permissions. The confidentiality impact is limited (low severity) as no integrity or availability impact exists, and exploitation requires authentication plus ID enumeration. However, in multi-tenant or shared Beszel deployments, this could expose sensitive operational data across organizational boundaries (GitHub Advisory).

A public proof-of-concept (PoC) with a complete 13-step reproduction guide using curl commands is available in the GitHub Security Advisory (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.048% (0.000480), reflecting low near-term exploitation probability. Exploitation requires valid credentials and the ability to enumerate a 15-character random alphanumeric system ID, which raises the practical attack complexity (Feedly).

1. Authenticate as a low-privileged user: Obtain a valid authentication token for any Beszel account (e.g., a readonly user) by POSTing credentials to /api/collections/users/auth-with-password.
2. Enumerate system IDs: Use the authenticated session to query the PocketBase collection API (/api/collections/systems/records) or probe the web API to discover valid 15-character alphanumeric system IDs belonging to other users. Note: the standard API returns only systems the user is assigned to, so enumeration must be performed by brute-forcing or guessing IDs.
3. Confirm IDOR: Verify that the standard PocketBase API returns 404 for the target system ID when queried with the attacker's token (confirming the user lacks legitimate access).
4. Access unauthorized system data via IDOR: Send a request to a vulnerable custom endpoint using the discovered system ID, e.g.:
   • POST http://<hub>:8090/api/beszel/smart/refresh?system=<SYSTEM_A_ID> with Authorization: <TOKEN_B>
   • GET http://<hub>:8090/api/beszel/systemd/info?system=<SYSTEM_A_ID>&service=sshd with Authorization: <TOKEN_B>
5. Access container data (optional): Enumerate a valid 12-digit hex container ID (e.g., from Docker), then query:
   • GET http://<hub>:8090/api/beszel/containers/logs?system=<SYSTEM_A_ID>&container=<CONTAINER_ID>
   • GET http://<hub>:8090/api/beszel/containers/info?system=<SYSTEM_A_ID>&container=<CONTAINER_ID>
6. Exfiltrate data: Parse the JSON responses to extract container logs, systemd service status, or Docker container metadata from the unauthorized system (GitHub Advisory).

• Network: Repeated or sequential HTTP requests to /api/beszel/containers/logs, /api/beszel/containers/info, /api/beszel/systemd/info, or /api/beszel/smart/refresh with varying system= query parameter values from a single authenticated user session, especially for system IDs not assigned to that user.
• Logs: Beszel hub access logs showing a low-privileged or readonly user account successfully receiving 200 OK responses from the above custom API endpoints for systems they are not members of; contrast with 404 responses to /api/collections/systems/records/<id> for the same system IDs.
• Behavioral: A single user account making a high volume of requests to enumerate system IDs (e.g., iterating over alphanumeric strings in the system= parameter) within a short time window (GitHub Advisory).

Upgrade Beszel to version 0.18.7 or later, which includes a fix (commit c7261b5) that adds proper authorization checks to the affected API endpoints. No official configuration-based workaround is provided; however, as an interim measure, network-level access controls (e.g., firewall rules, reverse proxy authentication) can be used to restrict API access to trusted users. Monitoring for suspicious enumeration patterns against the affected endpoints is also recommended (GitHub Release, GitHub Advisory).

The vulnerability was reported by three researchers — marduc812, kodareef5, and lakshayyverma — and disclosed via GitHub's coordinated security advisory process. No significant media coverage or notable public commentary beyond the advisory itself has been identified at this time (GitHub Advisory).