CWE-862

{
  "affected": [],
  "aliases": [
    "CVE-2026-90594"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-13T21:17:02Z",
    "severity": "LOW"
  },
  "details": "A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.",
  "id": "GHSA-5rvc-gp3g-98qc",
  "modified": "2026-09-13T21:31:43Z",
  "published": "2026-09-13T21:31:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90594"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wxiaoqi/Spring-Cloud-Platform/issues/64"
    },
    {
      "type": "WEB",
      "url": "https://github.com/user-attachments/files/30627348/poc_vuln1_failopen_authz.zip"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wxiaoqi/Spring-Cloud-Platform"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-90594"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/913788"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/403176"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/403176/cti"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-43665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-27T21:16:52Z",
    "severity": "MODERATE"
  },
  "details": "This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Sharing.",
  "id": "GHSA-5rwq-4jf8-hxpv",
  "modified": "2026-07-28T18:32:51Z",
  "published": "2026-07-27T21:31:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43665"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/128071"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/128072"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-27437"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-03T22:15:10Z",
    "severity": "LOW"
  },
  "details": "Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf allows Functionality Misuse.This issue affects Event Espresso 4 Decaf: from n/a through 4.10.44.Decaf.",
  "id": "GHSA-5rxf-8qhp-h9fh",
  "modified": "2024-06-04T00:30:47Z",
  "published": "2024-06-04T00:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27437"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/event-espresso-decaf/wordpress-event-espresso-4-decaf-plugin-4-10-44-decaf-bypass-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-27181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-18T22:16:26Z",
    "severity": "HIGH"
  },
  "details": "MajorDoMo (aka Major Domestic Module) allows unauthenticated arbitrary module uninstallation through the market module. The market module\u0027s admin() method reads gr(\u0027mode\u0027) from $_REQUEST and assigns it to $this-\u003emode at the start of execution, making all mode-gated code paths reachable without authentication via the /objects/?module=market endpoint. The uninstall mode handler calls uninstallPlugin(), which deletes module records from the database, executes the module\u0027s uninstall() method via eval(), recursively deletes the module\u0027s directory and template files using removeTree(), and removes associated cycle scripts. An attacker can iterate through module names and wipe the entire MajorDoMo installation with a series of unauthenticated GET requests.",
  "id": "GHSA-5v24-5hr7-xg26",
  "modified": "2026-02-19T00:30:30Z",
  "published": "2026-02-19T00:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/sergejey/majordomo/pull/1177"
    },
    {
      "type": "WEB",
      "url": "https://chocapikk.com/posts/2026/majordomo-revisited"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/majordomo-unauthenticated-module-uninstall-via-market-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-1641"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T19:15:18Z",
    "severity": "MODERATE"
  },
  "details": "The Accordion plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the \u0027accordions_duplicate_post_as_draft\u0027 function in all versions up to, and including, 2.2.96. This makes it possible for authenticated attackers, with contributor access and above, to duplicate arbitrary posts, allowing access to the contents of password-protected posts.",
  "id": "GHSA-5v2g-8pw8-cqg5",
  "modified": "2024-04-09T21:31:58Z",
  "published": "2024-04-09T21:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1641"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/accordions/tags/2.2.96/includes/duplicate-post.php"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?old_path=/accordions/tags/2.2.96\u0026old=3050599\u0026new_path=/accordions/tags/2.2.97\u0026new=3050599\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0e7e7c70-4d07-4550-9cf8-5135b87b67ca?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-96342"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-30T11:16:48Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.",
  "id": "GHSA-5v3m-5239-8x8w",
  "modified": "2026-09-30T12:35:17Z",
  "published": "2026-09-30T12:35:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96342"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/wpappninja/vulnerability/wordpress-wpmobile-app-plugin-11-83-sensitive-data-exposure-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-61983"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-13T10:16:47Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through \u003c= 5.0.30.",
  "id": "GHSA-5v3q-xc3m-8fm4",
  "modified": "2026-07-13T12:35:06Z",
  "published": "2026-07-13T12:35:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61983"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/church-admin/vulnerability/wordpress-church-admin-plugin-5-0-30-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-0817"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-09T16:16:08Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.",
  "id": "GHSA-5v56-6x55-vhpv",
  "modified": "2026-01-09T18:31:36Z",
  "published": "2026-01-09T18:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0817"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/q/I7ed0049691258c8bd2555e599b9b88490fbe3358"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T410560"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.10-0.20260703131214-23d1934099b0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84315"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:12:42Z",
    "nvd_published_at": "2026-10-12T21:17:21Z",
    "severity": "HIGH"
  },
  "details": "Reporter: Jagadesh Achanta\n\nTarget: `0xJacky/nginx-ui`\n\nAffected version / commit tested:\n- App version: `2.3.10`\n- Commit: `4948fba8744e82c3d7003f68ee164e9f49421066`\n- Disclosure channel: GitHub Private Vulnerability Reporting\n- Credential reference: `cred:github-jagstack-gh-cli`\n\n## AI assistance disclosure\n\nThis report was prepared by Jagadesh Achanta with assistance from OpenAI/Codex for public source review, local evidence collection, and report drafting.\n\n## Summary\n\nNginx UI has a short-lived OTP/passkey \"secure session\" step-up boundary for users with 2FA enabled. `RequireSecureSession()` rejects an OTP-enabled user\u0027s request unless the request includes a valid `X-Secure-Session-ID` issued after a fresh OTP/passkey verification.\n\nThe project already applies this step-up middleware to sensitive operations such as:\n\n- Nginx config create/edit/rename/delete;\n- site save/delete/enable/disable/rename/duplicate;\n- stream save/delete/enable/disable/rename/duplicate;\n- settings save and protected secret reads;\n- backup restore.\n\nHowever, several similarly sensitive authenticated mutation routes remain outside `RequireSecureSession()`. An attacker who obtains an authenticated JWT/session for a 2FA-enabled user, but does not have the victim\u0027s fresh OTP/passkey secure-session token, can still perform those operations.\n\nThe affected route groups include:\n\n- automatic backup create/modify/delete/restore/test-S3 operations;\n- DNS credential create/edit/delete operations;\n- certificate and ACME user create/modify/delete/register operations;\n- DNS domain, record, and DDNS create/update/delete operations;\n- Nginx reload/restart, stub-status toggle, performance-setting update, and module-cache refresh operations;\n- site/stream advanced-mode toggles and batch updates;\n- auto-certificate binding/unbinding for sites;\n- site navigation order and health-check updates.\n\nThis report is distinct from my earlier Nginx UI report about auto-backup path traversal. This report is about missing 2FA step-up authorization on sensitive authenticated mutation routes.\n\n## Why this is a security boundary\n\n`internal/middleware/secure_session.go` only requires a secure-session token for users with OTP enabled. For OTP users, it reads `X-Secure-Session-ID` from the header or query string and aborts with `401 Unauthorized` if the secure session is missing or invalid:\n\n```go\nif !cUser.EnabledOTP() {\n    c.Next()\n    return\n}\nssid := c.GetHeader(\"X-Secure-Session-ID\")\nif ssid == \"\" {\n    ssid = c.Query(\"X-Secure-Session-ID\")\n}\nif ssid == \"\" {\n    c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{\n        \"message\": \"Secure Session ID is empty\",\n    })\n    return\n}\n\nif user.VerifySecureSessionID(ssid, cUser.ID) {\n    c.Next()\n    return\n}\n```\n\n`internal/user/otp.go` issues the secure-session ID for only 10 minutes:\n\n```go\nfunc SetSecureSessionID(userId uint64) (sessionId string) {\n    sessionId = uuid.NewString()\n    cache.Set(secureSessionIDCacheKey(sessionId), userId, 10*time.Minute)\n    return\n}\n```\n\nThe UI/server already rely on this boundary for sensitive actions. For example, `api/config/router.go` wraps config mutations with `RequireSecureSession()`:\n\n```go\no := r.Group(\"\", middleware.RequireSecureSession())\n{\n    o.POST(\"configs\", AddConfig)\n    o.POST(\"config\", EditConfig)\n    o.POST(\"config_mkdir\", Mkdir)\n    o.POST(\"config_rename\", Rename)\n    o.POST(\"config_delete\", DeleteConfig)\n}\n```\n\n`api/sites/router.go` protects normal site mutations:\n\n```go\no := r.Group(\"\", middleware.RequireSecureSession())\n{\n    o.POST(\"sites/:name/rename\", RenameSite)\n    o.POST(\"sites/:name/enable\", EnableSite)\n    o.POST(\"sites/:name/disable\", DisableSite)\n    o.POST(\"sites/:name\", SaveSite)\n    o.DELETE(\"sites/:name\", DeleteSite)\n    o.POST(\"sites/:name/duplicate\", DuplicateSite)\n    o.POST(\"sites/:name/maintenance\", EnableMaintenanceSite)\n}\n```\n\n`api/streams/router.go` protects normal stream mutations, and `api/settings/router.go` protects secret reads/settings saves:\n\n```go\no := r.Group(\"\", middleware.RequireSecureSession())\n{\n    o.POST(\"streams/:name\", SaveStream)\n    o.POST(\"streams/:name/rename\", RenameStream)\n    o.POST(\"streams/:name/enable\", EnableStream)\n    o.POST(\"streams/:name/disable\", DisableStream)\n    o.DELETE(\"streams/:name\", DeleteStream)\n    o.POST(\"streams/:name/duplicate\", Duplicate)\n}\n```\n\n```go\nr.GET(\"settings/protected\", middleware.RequireSecureSession(), GetProtectedSetting)\nr.POST(\"settings\", middleware.RequireSecureSession(), SaveSettings)\n```\n\nThe repository\u0027s own tests also verify this expected behavior. `api/config/security_test.go`, `api/sites/security_test.go`, and `api/streams/security_test.go` each assert that OTP-enabled users receive `401 Unauthorized` when protected mutations are attempted without a secure session.\n\n## Affected routes outside the step-up boundary\n\nThe affected routes are under the authenticated private router:\n\n```go\ng := root.Group(\"/\", middleware.AuthRequired(), middleware.Proxy())\n```\n\nbut they do not add `middleware.RequireSecureSession()`.\n\n### Automatic backup management\n\n`api/backup/router.go` protects manual restore:\n\n```go\nr.POST(\"/restore\", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)\n```\n\nbut the automatic backup management router has no secure-session middleware:\n\n```go\nr.POST(\"/auto_backup\", CreateAutoBackup)\nr.POST(\"/auto_backup/:id\", ModifyAutoBackup)\nr.DELETE(\"/auto_backup/:id\", DestroyAutoBackup)\nr.PATCH(\"/auto_backup/:id\", RestoreAutoBackup)\nr.POST(\"/auto_backup/test_s3\", TestS3Connection)\n```\n\nThose handlers create or modify backup jobs, register cron jobs, test attacker-supplied S3 settings, and store S3 credentials:\n\n```go\n\"s3_access_key_id\":     \"omitempty\",\n\"s3_secret_access_key\": \"omitempty\",\n...\nif ctx.Model.Enabled {\n    if err := cron.AddAutoBackupJob(ctx.Model.ID, ctx.Model.CronExpression); err != nil {\n```\n\nThe model stores S3 secret material:\n\n```go\nS3AccessKeyID     string `json:\"s3_access_key_id\" gorm:\"comment:S3 access key ID;serializer:json[aes]\"`\nS3SecretAccessKey string `json:\"s3_secret_access_key\" gorm:\"comment:S3 secret access key;serializer:json[aes]\"`\n```\n\n### Certificate, ACME, and DNS credential management\n\n`api/certificate/router.go` registers credential and certificate mutations without `RequireSecureSession()`:\n\n```go\nr.POST(\"dns_credentials\", AddDnsCredential)\nr.POST(\"dns_credentials/:id\", EditDnsCredential)\nr.DELETE(\"dns_credentials/:id\", DeleteDnsCredential)\n\nr.POST(\"certs\", AddCert)\nr.POST(\"certs/:id\", ModifyCert)\nr.DELETE(\"certs/:id\", RemoveCert)\nr.PUT(\"cert_sync\", SyncCertificate)\n\nr.POST(\"acme_users\", CreateAcmeUser)\nr.POST(\"acme_users/:id\", ModifyAcmeUser)\nr.POST(\"acme_users/:id/register\", RegisterAcmeUser)\nr.DELETE(\"acme_users/:id\", DestroyAcmeUser)\n```\n\nThe DNS credential handlers persist provider configuration:\n\n```go\ndnsCredential := model.DnsCredential{\n    Name:         json.Name,\n    Config:       \u0026json.Config,\n    Provider:     json.Provider,\n    ProviderCode: providerCode,\n}\n...\nerr := d.Create(\u0026dnsCredential)\n```\n\nThe model serializes that configuration with AES:\n\n```go\nConfig *dns.Config `json:\"config,omitempty\" gorm:\"serializer:json[aes]\"`\n```\n\n### DNS domains, records, and DDNS\n\n`api/dns/router.go` registers DNS domain, record, and DDNS mutations without secure-session middleware:\n\n```go\ngroup.POST(\"/domains\", CreateDomain)\ngroup.POST(\"/domains/:id\", UpdateDomain)\ngroup.DELETE(\"/domains/:id\", DeleteDomain)\ngroup.POST(\"/domains/:id/records\", CreateRecord)\ngroup.PUT(\"/domains/:id/records/:record_id\", UpdateRecord)\ngroup.DELETE(\"/domains/:id/records/:record_id\", DeleteRecord)\ngroup.PUT(\"/domains/:id/ddns\", UpdateDDNSConfig)\ngroup.DELETE(\"/domains/:id/ddns\", DeleteDDNSConfig)\n```\n\nThose handlers call the DNS provider service and modify DDNS jobs:\n\n```go\nrecord, err := svc.CreateRecord(c.Request.Context(), domainID, toRecordInput(payload))\n...\nrecord, err := svc.UpdateRecord(c.Request.Context(), domainID, recordID, toRecordInput(payload))\n...\nif err := cron.AddOrUpdateDDNSJob(domainID, cfg.IntervalSeconds); err != nil {\n```\n\n### Nginx control and configuration-side effects\n\n`api/nginx/router.go` registers several server/Nginx mutation endpoints without `RequireSecureSession()`:\n\n```go\nr.POST(\"nginx/reload\", Reload)\nr.POST(\"nginx/restart\", Restart)\nr.POST(\"nginx/stub_status\", ToggleStubStatus)\nr.POST(\"nginx/performance\", UpdatePerformanceSettings)\nr.POST(\"nginx/modules/refresh\", RefreshModulesCache)\n```\n\nThe handlers perform control actions or persist Nginx-related changes:\n\n```go\nfunc Reload(c *gin.Context) {\n    nginx.Control(nginx.Reload).Resp(c)\n}\n\nfunc Restart(c *gin.Context) {\n    c.JSON(http.StatusOK, gin.H{\n        \"message\": \"ok\",\n    })\n    go nginx.Restart()\n}\n```\n\n```go\nif json.Enable {\n    err = performance.EnableStubStatus()\n} else {\n    err = performance.DisableStubStatus()\n}\n...\nreloadOutput, err := nginx.Reload()\n```\n\n```go\nerr := performance.UpdatePerfOpt(\u0026perfOpt)\n```\n\n### Site and stream advanced/batch mutations\n\n`api/sites/router.go` leaves these site mutations before the secure-session group:\n\n```go\nr.PUT(\"sites\", BatchUpdateSites)\nr.POST(\"sites/:name/advance\", DomainEditByAdvancedMode)\nr.POST(\"auto_cert/:name\", AddDomainToAutoCert)\nr.DELETE(\"auto_cert/:name\", RemoveDomainFromAutoCert)\nr.POST(\"site_navigation/order\", UpdateSiteOrder)\nr.POST(\"site_navigation/health_check/:id\", UpdateHealthCheck)\n```\n\n`DomainEditByAdvancedMode()` persists the site\u0027s `Advanced` mode:\n\n```go\n_, err = s.Where(s.Path.Eq(path)).Update(s.Advanced, json.Advanced)\n```\n\n`AddDomainToAutoCert()` writes certificate automation settings including DNS credential ID, domains, challenge method, and ACME user:\n\n```go\nerr = certModel.Updates(\u0026model.Cert{\n    Name:            name,\n    Domains:         json.Domains,\n    AutoCert:        model.AutoCertEnabled,\n    DnsCredentialID: json.DnsCredentialID,\n    ChallengeMethod: json.ChallengeMethod,\n    KeyType:         helper.GetKeyType(json.KeyType),\n    ACMEUserID:      json.ACMEUserID,\n})\n```\n\n`api/streams/router.go` protects normal stream save/delete operations, but leaves batch update and advanced-mode outside:\n\n```go\nr.PUT(\"streams\", BatchUpdateStreams)\n...\nr.POST(\"streams/:name/advance\", AdvancedEdit)\n```\n\n`AdvancedEdit()` persists the stream\u0027s `Advanced` mode:\n\n```go\n_, err = s.Where(s.Path.Eq(path)).Update(s.Advanced, json.Advanced)\n```\n\n## Safe local proof\n\nI did not access any external Nginx UI deployment. The following proof only inspects the checked-out source tree and confirms that:\n\n- `RequireSecureSession()` is a real OTP-gated 10-minute step-up mechanism;\n- high-risk control routes are intentionally protected elsewhere;\n- the affected route groups are authenticated but outside `RequireSecureSession()`;\n- the affected handlers perform persistent or server-control side effects.\n\nRun:\n\n```bash\npython3 reports/nginx-ui-missing-secure-session-step-up-poc.py\n```\n\nObserved output:\n\n```json\n{\n  \"all_affected_groups_present\": true,\n  \"all_controls_present\": true,\n  \"all_side_effects_present\": true,\n  \"commit\": \"4948fba8744e82c3d7003f68ee164e9f49421066\",\n  \"result\": \"VULNERABLE_SOURCE_CONFIRMED\",\n  \"target\": \"0xJacky/nginx-ui\"\n}\n```\n\nThe full local proof output is available in my workspace as `tmp/nginx-ui-missing-secure-session-step-up-poc-output.txt`.\n\n## HTTP reproduction outline\n\nThis is a local-only reproduction outline for an isolated Nginx UI test instance, consistent with the project\u0027s security policy:\n\n1. Create a test user with OTP enabled.\n2. Log in as that user and keep only the normal authenticated session/JWT.\n3. Do not obtain or send a fresh `X-Secure-Session-ID`.\n4. Verify the expected protected control behavior:\n\n```http\nPOST /api/config\nAuthorization: \u003cotp-user-session\u003e\nContent-Type: application/json\n\n{ \"name\": \"example.conf\", \"content\": \"server { listen 80; }\" }\n```\n\nExpected result: `401 Unauthorized` because config edits require `RequireSecureSession()`.\n\n5. Attempt an affected operation with the same OTP-enabled session and no `X-Secure-Session-ID`, for example:\n\n```http\nPOST /api/dns_credentials\nAuthorization: \u003cotp-user-session\u003e\nContent-Type: application/json\n\n{\n  \"name\": \"attacker-controlled-test\",\n  \"provider\": \"cloudflare\",\n  \"provider_code\": \"cloudflare\",\n  \"token\": \"test-token\"\n}\n```\n\nExpected secure behavior: `401 Unauthorized`, matching the secure-session requirement for other sensitive configuration changes.\n\nActual behavior from source review: the request reaches `AddDnsCredential()` because the DNS credential router is under `AuthRequired()` but does not apply `RequireSecureSession()`.\n\nThe same missing step-up applies to the other route groups listed above.\n\n## Impact\n\nIf an attacker obtains the authenticated web session/JWT for a 2FA-enabled Nginx UI user, the secure-session boundary should limit what they can do until they also pass a fresh OTP/passkey challenge. The current route map leaves major administrative actions outside that boundary.\n\nDepending on the victim user\u0027s privileges and deployment configuration, this can allow the attacker to:\n\n- add, edit, or remove DNS provider credentials;\n- alter certificate and ACME automation;\n- create, modify, delete, or restore automatic backup jobs;\n- configure S3 backup destinations and trigger S3 connection tests;\n- alter DNS domains, records, or DDNS schedules through configured providers;\n- restart or reload Nginx;\n- enable/disable stub-status and change performance settings;\n- switch sites/streams into advanced mode or change site automation bindings.\n\nThis undermines the value of the secure-session step-up for OTP-enabled accounts. I am not claiming pre-authentication access or remote code execution from this issue. The issue is missing step-up authorization for sensitive authenticated mutations.\n\n## Suggested fix\n\nRecommended mitigation:\n\n1. Apply `middleware.RequireSecureSession()` to all high-impact authenticated mutation routes that alter server, Nginx, certificate, DNS, backup, credential, or automation state.\n2. At minimum, protect:\n   - auto-backup create/modify/delete/restore/test-S3;\n   - DNS credential create/edit/delete;\n   - certificate and ACME user mutations;\n   - DNS domain, record, and DDNS mutations;\n   - Nginx reload/restart/stub-status/performance/module-cache mutation routes;\n   - site/stream advanced-mode, batch, auto-cert, navigation order, and health-check mutations.\n3. Add regression tests mirroring the existing config/site/stream security tests:\n   - OTP-enabled user without `X-Secure-Session-ID` receives `401`;\n   - OTP-enabled user with a valid secure-session ID succeeds;\n   - non-OTP users retain existing behavior if that is the intended product policy.\n4. Consider centralizing \"sensitive mutation\" routing to make future omissions harder.",
  "id": "GHSA-5v7c-xpfp-p65m",
  "modified": "2026-10-15T20:12:42Z",
  "published": "2026-10-15T20:12:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5v7c-xpfp-p65m"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84315"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nginx UI OTP secure-session step-up is missing on sensitive mutation routes"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-24546"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-25T20:16:36Z",
    "severity": "MODERATE"
  },
  "details": "Missing Authorization vulnerability in Ruben Garcia GamiPress allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects GamiPress: from n/a through 7.6.3.",
  "id": "GHSA-5v8g-2w9g-6cwm",
  "modified": "2026-05-26T13:30:49Z",
  "published": "2026-05-26T13:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24546"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/gamipress/vulnerability/wordpress-gamipress-plugin-7-6-3-broken-access-control-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}