Beszel versions prior to 0.19.0 contain an insecure direct object reference flaw in the POST and DELETE /api/beszel/user-alerts endpoints. An attacker who is authenticated can supply arbitrary system identifiers in the request body, causing the application to create or delete alert rules for systems the user has no permission to view. This actions also return system names and key metrics, thus revealing sensitive operational data. The weakness is a classic IDOR issue, classified as CWE‑639.

The affected product is Beszel, developed by henrygd. All releases before version 0.19.0 are vulnerable, as the patch that removes the ability for authenticated users to specify arbitrary system IDs is introduced in v0.19.0.

The CVSS score of 2.3 indicates low overall severity, but the flaw can be exercised by any authenticated user and may expose sensitive system details. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is via the HTTP API; an attacker needs valid credentials to trigger the denial or reveal system information. The impact is mainly information exposure and privileged privilege escalation within alert management rather than immediate control of the target system.