GHSA-2GC7-J998-5XX6

Vulnerability from github – Published: 2026-10-15 20:11 – Updated: 2026-10-15 20:11
VLAI
Summary
Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Details

Summary

POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession (2FA verification). In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.

Details

nginx-ui enforces RequireSecureSession middleware on sensitive operations such as self password change (api/user/router.go:55), self profile update (api/user/router.go:54), settings modification (api/settings/router.go:12), and config file deletion/rename (api/config/router.go:16-21).

However, the user management endpoint registered in InitManageUserRouter (api/user/user.go:31-68) is mounted on the g router group (router/routers.go:92) which only applies middleware.AuthRequired() and middleware.Proxy() — no RequireSecureSession().

As a result, POST /api/users/:id with a password field in the JSON body updates the target user's password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.

The attack flow:

  1. Attacker authenticates as any user (e.g., user ID 2).
  2. Attacker sends POST /api/users/1 with {"password": "attacker-chosen"}.
  3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (api/user/user.go:48-49).
  4. Attacker logs in as admin with the new password.
  5. Admin is locked out.

PoC

poc.zip

Please extract the uploaded compressed file before proceeding

  1. docker compose up -d
  2. python3 poc.py

스크린샷 2026-04-22 오후 10 26 29

Impact

  • Any authenticated user can change any other user's password, including the initial admin (user ID 1).
  • Full account takeover of the admin account.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.10-0.20260703131214-23d1934099b0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84314"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:11:45Z",
    "nvd_published_at": "2026-10-12T21:17:21Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n`POST /api/users/:id` allows any authenticated user to change any other user\u0027s password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.\n\n### Details\nnginx-ui enforces `RequireSecureSession` middleware on sensitive operations such as self password change (`api/user/router.go:55`), self profile update (`api/user/router.go:54`), settings modification (`api/settings/router.go:12`), and config file deletion/rename (`api/config/router.go:16-21`).\n\nHowever, the user management endpoint registered in `InitManageUserRouter` (`api/user/user.go:31-68`) is mounted on the `g` router group (`router/routers.go:92`) which only applies `middleware.AuthRequired()` and `middleware.Proxy()` \u2014 **no `RequireSecureSession()`**.\n\nAs a result, `POST /api/users/:id` with a `password` field in the JSON body updates the target user\u0027s password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.\n\nThe attack flow:\n\n1. Attacker authenticates as any user (e.g., user ID 2).\n2. Attacker sends `POST /api/users/1` with `{\"password\": \"attacker-chosen\"}`.\n3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (`api/user/user.go:48-49`).\n4. Attacker logs in as admin with the new password.\n5. Admin is locked out.\n\n\n### PoC\n[poc.zip](https://github.com/user-attachments/files/26971275/poc.zip)\n\nPlease extract the uploaded compressed file before proceeding\n\n1. docker compose up -d\n2. python3 poc.py\n\n\u003cimg width=\"501\" height=\"55\" alt=\"\u1109\u1173\u110f\u1173\u1105\u1175\u11ab\u1109\u1163\u11ba 2026-04-22 \u110b\u1169\u1112\u116e 10 26 29\" src=\"https://github.com/user-attachments/assets/6562ede2-7c11-48da-b905-be9964f4f7b1\" /\u003e\n\n\n### Impact\n- Any authenticated user can change any other user\u0027s password, including the initial admin (user ID 1).\n- Full account takeover of the admin account.",
  "id": "GHSA-2gc7-j998-5xx6",
  "modified": "2026-10-15T20:11:45Z",
  "published": "2026-10-15T20:11:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84314"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.