The vulnerability arises from the PATCH /server/{id} endpoint, which accepts and persists DDNS profile identifiers that do not yet exist for a member‑owned server. When another user later creates a DDNS profile with one of those placeholder IDs, the DDNS worker resolves the stored identifier and dispatches an update using the other user's DDNS profile configuration in the context of the attacker's server. This flaw, classified as CWE‑863, allows an attacker to force the system to use an unauthorized DDNS configuration on a target server, potentially altering DNS records without the victim’s consent.

Nezha Monitoring, a self‑hosted monitoring tool, is affected from version 2.0.14 up to but not including 2.1.0. Users running any 2.0.x build in that range are vulnerable.

The CVSS score of 6.4 indicates a moderate severity. No EPSS score is reported and the vulnerability is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Exploitation requires authenticated access to create a member‑owned server and later relies on a victim creating a DDNS profile with the same ID that an attacker had persisted. The attack vector is remote, through HTTP requests, and could be automated. If successful, the attacker can impersonate the victim’s DDNS configuration, potentially redirecting traffic or hijacking domain resolution.