Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

LOW 3.1CVE-2026-40077 · GHSA-5f5r-95pg-xrpm · GO-2026-5141 · Published 09/04/2026 · updated 26/10/2026

In short

CVE-2026-40077 is a LOW (CVSS 3.1) vulnerability affecting github.com/henrygd/beszel, beszel (beszel).
Chance of exploitation in the next 30 days (EPSS): 0.23%, higher than 13.6% of all vulnerabilities.
Fix: update to 0.18.7 or later.

Package	Affected versions	Patched versions
github.com/henrygd/beszel Go	`< 0.18.7`	`0.18.7`
beszel beszel	`< 0.18.7`	`0.18.7`

Description

Summary

Some API endpoints in the Beszel hub accept a user-supplied system ID and proceed without further checks that the user should have access to that system. As a result, any authenticated user can access these routes for any system if they know the system's ID.

System IDs are random 15 character alphanumeric strings, and are not exposed to all users. However, it is theoretically possible for an authenticated user to enumerate a valid system ID via web API. To use the containers endpoints, the user would also need to enumerate a container ID, which is 12 digit hexadecimal string.

Affected Component

File: internal/hub/api.go, lines 283–361
Endpoints:
- GET /api/beszel/containers/logs?system=SYSTEM_ID&container=CONTAINER_ID
- GET /api/beszel/containers/info?system=SYSTEM_ID&container=CONTAINER_ID
- GET /api/beszel/systemd/info?system=SYSTEM_ID&service=SERVICE_NAME
- POST /api/beszel/smart/refresh?system=SYSTEM_ID
Commit: c7261b56f1bfb9ae57ef0856a0052cabb2fd3b84

Vulnerable Code

The containerRequestHandler function retrieves a system by ID but never verifies the authenticated user is a member of that system:

// internal/hub/api.go:283-305
func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*systems.System, string) (string, error), responseKey string) error {
    systemID := e.Request.URL.Query().Get("system")
    containerID := e.Request.URL.Query().Get("container")

    if systemID == "" || containerID == "" {
        return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and container parameters are required"})
    }
    if !containerIDPattern.MatchString(containerID) {
        return e.JSON(http.StatusBadRequest, map[string]string{"error": "invalid container parameter"})
    }

    system, err := h.sm.GetSystem(systemID)
    // ^^^ No authorization check: e.Auth.Id is never verified against system.users
    if err != nil {
        return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
    }

    data, err := fetchFunc(system, containerID)
    if err != nil {
        return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
    }

    return e.JSON(http.StatusOK, map[string]string{responseKey: data})
}

The same pattern applies to getSystemdInfo (lines 322–340) and refreshSmartData (lines 342–361).

Meanwhile, the standard PocketBase collection API enforces proper membership checks:

References

henrygd/beszel security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-40077 · ADVISORY
henrygd/beszel · PACKAGE
henrygd/beszel release v0.18.7 · WEB

More vulnerabilities in github.com/henrygd/beszel

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

github.com/henrygd/beszel

< 0.18.7

0.18.7

beszel

< 0.18.7

0.18.7

Description

Summary

Affected Component

File: internal/hub/api.go, lines 283–361
Endpoints:
- GET /api/beszel/containers/logs?system=SYSTEM_ID&container=CONTAINER_ID
- GET /api/beszel/containers/info?system=SYSTEM_ID&container=CONTAINER_ID
- GET /api/beszel/systemd/info?system=SYSTEM_ID&service=SERVICE_NAME
- POST /api/beszel/smart/refresh?system=SYSTEM_ID
Commit: c7261b56f1bfb9ae57ef0856a0052cabb2fd3b84

Vulnerable Code

The containerRequestHandler function retrieves a system by ID but never verifies the authenticated user is a member of that system:

// internal/hub/api.go:283-305
func (h *Hub) containerRequestHandler(e *core.RequestEvent, fetchFunc func(*systems.System, string) (string, error), responseKey string) error {
    systemID := e.Request.URL.Query().Get("system")
    containerID := e.Request.URL.Query().Get("container")

    if systemID == "" || containerID == "" {
        return e.JSON(http.StatusBadRequest, map[string]string{"error": "system and container parameters are required"})
    }
    if !containerIDPattern.MatchString(containerID) {
        return e.JSON(http.StatusBadRequest, map[string]string{"error": "invalid container parameter"})
    }

    system, err := h.sm.GetSystem(systemID)
    // ^^^ No authorization check: e.Auth.Id is never verified against system.users
    if err != nil {
        return e.JSON(http.StatusNotFound, map[string]string{"error": "system not found"})
    }

    data, err := fetchFunc(system, containerID)
    if err != nil {
        return e.JSON(http.StatusNotFound, map[string]string{"error": err.Error()})
    }

    return e.JSON(http.StatusOK, map[string]string{responseKey: data})
}

The same pattern applies to getSystemdInfo (lines 322–340) and refreshSmartData (lines 342–361).

Meanwhile, the standard PocketBase collection API enforces proper membership checks:

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

In short

Description

Summary

Affected Component

Vulnerable Code

References

More vulnerabilities in github.com/henrygd/beszel

Beszel has an IDOR in hub API endpoints that read system ID from URL parameter

In short

Description

Summary

Affected Component

Vulnerable Code

References

More vulnerabilities in github.com/henrygd/beszel

PoC

Step 1: Start the hub

Step 2: Create User A (admin)

Step 3: Create User B (readonly)

Step 4: Authenticate as User A

Step 5: Get hub public key

Step 6: Create a universal token and start the agent

Step 7: Verify User A sees the system

Step 8: Authenticate as User B (readonly)

Step 9: Control test — standard API blocks User B

Step 10: IDOR — SMART refresh (User B triggers action on User A's system)

Step 11: IDOR — Systemd info (User B reads from User A's system)

Step 12: IDOR — Container logs (User B reads from User A's system)

Step 13: IDOR — Container info (User B reads from User A's system)

Impact