Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.

CVE-2026-62283 affects Nezha Monitoring, a self-hostable server and website monitoring tool. Affected versions include 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9. The vulnerability stems from stream identifiers created by CreateStream in service/rpc/io_stream.go not being bound to their creating user. The WebSocket endpoints GET /ws/terminal/:id and GET /ws/file/:id only verify UUID existence without validating ownership. An authenticated RoleMember who obtains a valid stream UUID can hijack another user's terminal or file-manager session. This allows the attacker to read and write files on the target server and execute arbitrary shell commands. The UUID could be obtained via logs, browser history, referer headers, or telemetry data. The vulnerability is fixed in version 2.0.10, with a patch available in the referenced GitHub commit.