CVE-2026-40077 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter
Authenticated users can access system data for other users by guessing system IDs due to missing authorization checks in the hub API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40077?
CVE-2026-40077 is a low-severity missing authorization vulnerability in henrygd beszel, published on 9 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Beszel is a server monitoring platform. Prior to 0.18.7, some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID. System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string. This vulnerability is fixed in 0.18.7.
Weakness: CWE-184
Which versions are affected by CVE-2026-40077?
3 open source packages ship an affected version, including github.com/henrygd/beszel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/henrygd/beszel Go | All versions | 0.18.7 |
github.com/henrygd/beszel Go | All versions | 0.18.7 |
github.com/henrygd/beszel Go | All versions | 0.18.7 |
Products include Beszel Beszel.
How do I fix CVE-2026-40077?
Upgrade github.com/henrygd/beszel to 0.18.7 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-40077 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40077 exists.
Other vulnerabilities in henrygd beszel
Sources
Also known as GHSA-5f5r-95pg-xrpm, GO-2026-5141.