Nezha Monitoring, a self-hostable monitoring tool, has an incorrect authorization vulnerability (CWE-863) in versions 1.4.0 through before 2.0.8. The dashboard supports two roles: RoleAdmin and RoleMember. The notification routes POST /api/v1/notification and PATCH /api/v1/notification/:id are handled by commonHandler instead of adminHandler, allowing RoleMember users to invoke them. These handlers send HTTP requests to URLs controlled by the user and reflect the entire response body back to the caller if the response status is not 2xx. This vulnerability was patched in version 2.0.8.

An attacker with RoleMember privileges can invoke notification API endpoints that should be restricted to administrators. This allows sending HTTP requests to arbitrary URLs controlled by the attacker and receiving the full response body on error responses. The CVSS score of 7.7 indicates high severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality impact is high, but integrity and availability impacts are none.

Upgrade Nezha Monitoring to version 2.0.8 or later, where this authorization issue is fixed. Since this is a self-hosted product, administrators must apply this update to remediate the vulnerability. Patch status is confirmed by the vendor advisory stating the issue is fixed in version 2.0.8.