Nezha Monitoring is affected by an authorization bypass vulnerability (CVE-2026-62283) due to improper binding of stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user. The endpoints GET /ws/terminal/:id and GET /ws/file/:id only verify the existence of the UUID without confirming user ownership. An authenticated user with RoleMember privileges who obtains a live stream UUID through logs, browser history, referer data, or telemetry can attach to another user's session, gaining unauthorized access to terminal and file-manager functionalities, including reading, writing files, and executing shell commands. The vulnerability affects versions 1.14.13, 1.14.14, and all 2.0.x versions up to but not including 2.0.10. The issue is resolved in version 2.0.10.

An authenticated user with RoleMember privileges can bypass authorization controls to access and control other users' terminal and file-manager sessions. This includes the ability to read and write files on the target server and execute arbitrary shell commands, resulting in full compromise of the affected system's confidentiality, integrity, and availability.

Upgrade Nezha Monitoring to version 2.0.10 or later, where this vulnerability is fixed. There is no indication of any temporary workaround or mitigation other than applying the official fix.