Executive brief
Nezha Monitoring is a tool used by administrators to manage and monitor servers and websites. A security flaw allows regular users to trigger automated maintenance tasks (cron jobs) that were created by administrators. This could allow a low-privileged user to force the execution of administrative commands across all managed servers, potentially disrupting operations or causing unauthorized system changes.
Technical details
A missing authorization check (CWE-862) exists in the 'createAlertRule' and 'createService' functions within Nezha Monitoring. Authenticated users with 'RoleMember' privileges can submit 'FailTriggerTasks' or 'RecoverTriggerTasks' containing arbitrary cron task IDs. The application fails to verify if the requesting user owns the specified cron tasks. When the alert or service monitor is triggered, the system executes the linked cron tasks. If these tasks are configured with broad coverage (e.g., 'CronCoverAll'), the commands are broadcast to all connected agents, allowing a non-admin user to invoke administrative actions globally. This issue is patched in version 2.0.8.
Affected products
- NezhaHQ Nezha Monitoring >= 1.4.0, < 2.0.8
Timeline
- 2026-05-17: advisory: Original GitHub security advisory published
- 2026-06-12: disclosed: CVE published to NVD
- 2026-06-12: patched: Fix released in version 2.0.8