Nezha before version 2.2.7 includes an information disclosure flaw in the GET /api/v1/profile endpoint. The endpoint returns the bcrypt-hashed password field of users that are already authenticated. As a result, an attacker who can rely on authenticated access can collect password hashes and subsequently perform offline cracking attempts. The vulnerability does not allow arbitrary code execution or modification of system state, but it exposes a valuable credential that can be reused for further attacks against other services.

The affected product is Nezha, maintained by nezhahq, and any installation running a version older than 2.2.7 is vulnerable. Systems with that version should be promptly updated to 2.2.7 or later to remove the return of the hashed password field.

The CVSS score of 2.3 indicates a low overall impact, and the EPSS score is not available; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that an attacker must first authenticate with valid credentials or leverage compromised credentials; once authenticated, the attacker can request the profile endpoint and obtain the hash with no rate limiting or audit trail constraints. While the exploit does not directly provide system compromise, the exposure of password hashes represents a confidentiality risk that could enable credential reuse or further exploitation; this inference is based on common attack patterns.