The vulnerability lies in the server-status WebSocket endpoint. Authenticated users who are not administrators can connect and receive telemetry for every server in the deployment, regardless of ownership. This unintended data access breaches confidentiality, allowing cross‑tenant leakage of operational metrics. The weakness is classified as CWE‑200 (information exposure).

Nezha Monitoring from vendor nezhahq is affected by this flaw. Any deployment running a version from 1.4.0 up to, but not including, 2.0.9 is vulnerable; the patch is included in version 2.0.9 and later.

The CVSS score of 6.5 places the vulnerability in the moderate severity range. The EPSS score of <1% indicates a very low likelihood of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only that an attacker exist an authenticated non‑admin account, making the attack path straightforward. The attack would result solely in data disclosure, with no impact on availability or integrity beyond the breach of telemetry visibility.