https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 13:01:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84314 <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user&#39;s password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator&#39;s password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.</p> <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user&#39;s password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator&#39;s password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84314 https://db.gcve.eu/vuln/ghsa-2gc7-j998-5xx6 <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>### Summary `POST /api/users/:id` allows any authenticated user to change any other user&#39;s password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.</p> <p>### Details nginx-ui enforces `RequireSecureSession` middleware on sensitive operations such as self password change (`api/user/router.go:55`), self profile update (`api/user/router.go:54`), settings modification (`api/settings/router.go:12`), and config file deletion/rename (`api/config/router.go:16-21`).</p> <p>However, the user management endpoint registered in `InitManageUserRouter` (`api/user/user.go:31-68`) is mounted on the `g` router group (`router/routers.go:92`) which only applies `middleware.AuthRequired()` and `middleware.Proxy()` — **no `RequireSecureSession()`**.</p> <p>As a result, `POST /api/users/:id` with a `password` field in the JSON body updates the target user&#39;s password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.</p> <p>The attack flow:</p> <p>1. Attacker authenticates as any user (e.g., user ID 2). 2. Attacker sends `POST /api/users/1` with `{&#34;password&#34;: &#34;attacker-chosen&#34;}`. 3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (`api/user/user.go:48-49`). 4. Attacker…</p> <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>### Summary `POST /api/users/:id` allows any authenticated user to change any other user&#39;s password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.</p> <p>### Details nginx-ui enforces `RequireSecureSession` middleware on sensitive operations such as self password change (`api/user/router.go:55`), self profile update (`api/user/router.go:54`), settings modification (`api/settings/router.go:12`), and config file deletion/rename (`api/config/router.go:16-21`).</p> <p>However, the user management endpoint registered in `InitManageUserRouter` (`api/user/user.go:31-68`) is mounted on the `g` router group (`router/routers.go:92`) which only applies `middleware.AuthRequired()` and `middleware.Proxy()` — **no `RequireSecureSession()`**.</p> <p>As a result, `POST /api/users/:id` with a `password` field in the JSON body updates the target user&#39;s password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.</p> <p>The attack flow:</p> <p>1. Attacker authenticates as any user (e.g., user ID 2). 2. Attacker sends `POST /api/users/1` with `{&#34;password&#34;: &#34;attacker-chosen&#34;}`. 3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (`api/user/user.go:48-49`). 4. Attacker…</p> https://db.gcve.eu/vuln/ghsa-2gc7-j998-5xx6