CVE-2026-111386: Observable Response Discrepancy in nezhahq nezha

CVE-2026-111386 describes an information disclosure vulnerability in Nezha versions >=1.7.0 and <2.3.15. Authenticated members can exploit observable response discrepancies in the getServerConfig and setServerConfig endpoints to enumerate server IDs of other tenants. By sweeping sequential server IDs and analyzing the differential responses, attackers can identify valid server IDs belonging to other users, leading to unauthorized information disclosure.

The vulnerability allows authenticated users to enumerate server IDs of other tenants, potentially exposing information about other users' infrastructure. This could facilitate further targeted attacks or reconnaissance but does not directly allow privilege escalation or remote code execution according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the vendor's official channels for updates and apply any official fixes once available. Until then, restricting authenticated user permissions and monitoring API usage may help reduce risk.