Beszel, a server monitoring platform, contains an IDOR flaw in its hub API endpoints. The flaw allows any authenticated user to submit a system ID in the URL and the API returns information for that system without verifying the user’s privileges. Because system IDs are random 15‑character alphanumeric strings, a user who knows or can enumerate a valid ID can read data from any system, potentially leaking sensitive configuration or monitoring information.

Vendors: henrygd:beszel. Affected versions are all releases prior to 0.18.7; version 0.18.7 and later contain the fix and are not vulnerable.

The CVSS score of 3.5 indicates low severity, yet the flaw provides unauthorized read access across the entire system inventory for any authenticated user. Exploitation requires only the ability to guess or enumerate system IDs and, for certain container endpoints, container IDs. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, implying limited public awareness or active exploitation. However, the relatively simple attack path and the fact that users can intentionally enumerate IDs and containers suggest the risk is non-trivial in environments where many systems are monitored.