PT-2026-28800 · Unknown · Nezha Monitoring

CVE-2026-53521 · Published 2026-03-28 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Nezha Monitoring versions 2.0.14 through 2.0.19

Description The software allows the 'PATCH /server/{id}' endpoint to accept and store nonexistent ddns profiles IDs for a server owned by a member. If a different user subsequently creates a DDNS profile using one of those IDs, the DDNS worker resolves the stored ID and sends an update using the second user's DDNS profile configuration within the context of the first user's server.

Recommendations Update to version 2.1.0.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-53521

GHSA-39G2-8X68-PMX8

GO-2026-5826

OPENSUSE-SU-2026:21483-1

Affected Products

Nezha Monitoring

References · 1745

• 🔥 https://github.com/nezhahq/nezha/security/advisories/GHSA-39g2-8x68-pmx8 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53521.json · Exploit
• https://osv.dev/vulnerability/GO-2026-5826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53521 · Security Note
• https://osv.dev/vulnerability/GHSA-39g2-8x68-pmx8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-53521 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/nezhahq/nezha · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://suse.com/security/cve/CVE-2026-25232 · Note
• https://suse.com/security/cve/CVE-2026-55513 · Note