CVE-2026-101089 - Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Back Back to CVE browser

LOW

Nezha before 2.2.7 Information Disclosure via /api/v1/profile

Published Sep 27, 2026

2.3

LOW

CVSS 4.0

EPSS 0.15%

Description

Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field of authenticated users. Attackers can extract password hashes and perform offline cracking attacks without rate limiting or audit trail constraints.

Affected products

Vendor Nezhahq Product Nezha Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <2.2.7
- Version
  2.2.7
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nezhahq

Nezha

unaffected

Version	Status	Constraints
0	affected	<2.2.7
2.2.7	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88024
Advisory
https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f
vendor-advisory
https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-via-api-v1-profile
third-party-advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88024		Advisory
https://github.com/nezhahq/nezha/security/advisories/GHSA-8jhq-g4gw-rv5f		vendor-advisory
https://www.vulncheck.com/advisories/nezha-before-2.2.7-information-disclosure-via-api-v1-profile		third-party-advisory