A critical authorization bypass vulnerability in nezhahq nezha allows authenticated users to hijack other sessions, leading to potential full server control.

This is an authorization bypass vulnerability (CWE-639) where stream identifiers are not correctly bound to the creating user. An authenticated RoleMember can hijack terminal or file-manager sessions belonging to other users if they obtain the corresponding stream UUID, leading to arbitrary command execution on the target server.

This vulnerability allows a malicious or compromised user to escalate privileges and gain unauthorized access to remote servers managed by the platform. The impact is severe, as it facilitates unauthorized file access, remote shell execution, and potential lateral movement across the monitored infrastructure. The CVSS score of 9.9 highlights the extreme risk to system integrity.

Immediate Action: Upgrade to version 2.0.10 or later to ensure that stream identifiers are properly bound to the authenticated user.

Proactive Monitoring: Review application logs for unusual access patterns to terminal or file-manager endpoints, specifically looking for attempts to access sessions with unknown or mismatched UUIDs.

Compensating Controls: Limit access to the Nezha dashboard to trusted internal networks and implement strict role-based access control to reduce the pool of potential attackers.

Public Exploit Available: Unknown

All administrators should update their Nezha installations to version 2.0.10 immediately. Ensuring that session authorization is correctly enforced is critical to maintaining the security of the monitored server environment.