All vulnerabilities
CVE-2026-84314GHSA-2gc7-j998-5xx6GO-2026-6771

github.com/0xJacky/Nginx-UI: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

0xJacky github.com/0xJacky/Nginx-UIgoWeb servers
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.9.10-0.20260703131214-23d1934099b0Fixed versionGitHub
Published12 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1.9.10-0.20260703131214-23d1934099b0github.com/0xJacky/Nginx-UI, goGitHubgo get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0
  • 1.9.10-0.20260703131214-23d1934099b0github.com/0xJacky/Nginx-UI, GoOSVgo get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260703131214-23d1934099b0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession (2FA verification). In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.

Details

nginx-ui enforces RequireSecureSession middleware on sensitive operations such as self password change (api/user/router.go:55), self profile update (api/user/router.go:54), settings modification (api/settings/router.go:12), and config file deletion/rename (api/config/router.go:16-21).

However, the user management endpoint registered in InitManageUserRouter (api/user/user.go:31-68) is mounted on the g router group (router/routers.go:92) which only applies middleware.AuthRequired() and middleware.Proxy() — **no RequireSecureSession()**.

As a result, POST /api/users/:id with a password field in the JSON body updates the target user's password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.

The attack flow:

  1. Attacker authenticates as any user (e.g., user ID 2).
  2. Attacker sends POST /api/users/1 with {"password": "attacker-chosen"}.
  3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (api/user/user.go:48-49).
  4. Attacker logs in as admin with the new password.
  5. Admin is locked out.

PoC

poc.zip

Please extract the uploaded compressed file before proceeding

  1. docker compose up -d
  2. python3 poc.py

<img width="501" height="55" alt="스크린샷 2026-04-22 오후 10 26 29" src="https://github.com/user-attachments/assets/6562ede2-7c11-48da-b905-be9964f4f7b1" />

Impact

  • Any authenticated user can change any other user's password, including the initial admin (user ID 1).
  • Full account takeover of the admin account.

Text from GitHub Advisory Database

Affected versions 3

  • github.com/0xJacky/Nginx-UI, go< 1.9.10-0.20260703131214-23d1934099b0GitHub
  • nginx-uiaffected: < 2.4.1CVE List
  • github.com/0xJacky/Nginx-UI, Gofrom first release, fixed in 1.9.10-0.20260703131214-23d1934099b0OSV

References 5