CVE-2026-84314
highpriority · track · 0OT risk · elevatedEPSS 0.004 · 36 %ileRUUSEPSS · scored 2026-10-27
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.3–8.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
- Go github.com/0xJacky/Nginx-UI< 1.9.10-0.20260703131214-23d1934099b0osvUSpkg:golang/github.com/0xJacky/Nginx-UI
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-2gc7-j998-5xx6Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint2026-10-15ghsa · osvUS
### Summary `POST /api/users/:id` allows any authenticated user to change any other user's password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password. ### Details nginx-ui enforces `RequireSecureSession` middleware on sensitive operations such as self password change (`api/user/router.go:55`), self profile update (`api/user/router.go:54`), settings modification (`api/settings/router.go:12`), and config file deletion/rename (`api/config/router.go:16-21`). However, the user management endpoint registered in `InitManageUserRouter` (`api/user/user.go:31-68`) is mounted on the `g` router group (`router/routers.go:92`) which only applies `middleware.AuthRequired()` and `middleware.Proxy()` — **no `RequireSecureSession()`**. As a result, `POST /api/users/:id` with a `password` field in the JSON body updates the target user's password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled. The attack flow: 1. Attacker authenticates as any user (e.g., user ID 2). 2. Attacker sends `POST /api/users/1` with `{"password": "attacker-chosen"}`. 3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (`api/user/user.go:48-49`). 4. Attacker logs in as admin with the new password. 5. Admin is locked out. ### PoC [poc.zip](https://github.com/user-attachments/files/26971275/poc.zip) Please extract the uploaded compressed file before proceeding 1. docker compose up -d 2. python3 poc.py <img width="501" height="55" alt="스크린샷 2026-04-22 오후 10 26 29" src="https://github.com/user-attachments/assets/6562ede2-7c11-48da-b905-be9964f4f7b1" /> ### Impact - Any authenticated user can change any other user's password, including the initial admin (user ID 1). - Full account takeover of the admin account.
- GO-2026-6771Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI2026-10-19vendor · osvUS
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan