CVE-2026-94382 is an insecure direct object reference vulnerability affecting Beszel versions prior to 0.19.0. The flaw exists in the POST and DELETE /api/beszel/user-alerts handlers, allowing authenticated users to bypass authorization controls by specifying arbitrary system IDs. This enables unauthorized creation or deletion of alerts on systems outside their access rights, potentially exposing system names and metrics through alert notifications.

The vulnerability allows authenticated users to manipulate alert rules on unauthorized systems, which can lead to information disclosure of system names and metrics. The CVSS 4.0 base score is 2.3, indicating a low severity impact. There is no indication of privilege escalation or system compromise beyond unauthorized alert management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints and monitor for unusual alert rule creation or deletion activities by authenticated users.