Nezha versions from 1.7.0 up to 2.3.14 allow authenticated members to discover the server identifiers of other tenants by probing the getServerConfig and setServerConfig endpoints. The service returns distinct responses for successful requests versus those that are denied, enabling an attacker to iterate over potential IDs and detect which ones belong to other tenants. The primary impact is the disclosure of sensitive configuration data, which could facilitate downstream attacks such as privilege escalation or lateral movement within the platform. The weakness aligns with CWE-204, indicating an insufficient access control for information exposure.

The affected product is Nezha from the vendor nezhahq. All releases from 1.7.0 through 2.3.14, inclusive, contain the flaw. Users running any of these versions should verify their installation and plan an upgrade to a patched release. No other versions are listed as affected.

The CVSS score of 5.3 reflects a moderate severity based on confidentiality impact and the need for an authenticated user. The EPSS score of < 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, so it has not yet been observed in the wild. The likely attack path requires an authenticated membership within a tenant, and the attacker sweeps sequential identifiers until a successful response is returned. The differential response technique is simple to implement but requires database or API access, meaning that an insider or compromised privileged account could exploit the flaw.