CVE-2026-84314

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6

Configurations

No configuration.

History

13 Oct 2026, 18:17

Type	Values Removed	Values Added
References	~~() https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6 -~~	() https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6 -

12 Oct 2026, 21:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-12 21:17

Updated : 2026-10-13 18:17

NVD link : CVE-2026-84314

Mitre link : CVE-2026-84314

CVE.ORG link : CVE-2026-84314

JSON object : View

Products Affected

No product.

CWE

CWE-285

Improper Authorization

CWE-862

Missing Authorization

{"id": "CVE-2026-84314", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84314", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-13T17:31:07.190328Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "0xJacky", "product": "nginx-ui", "versions": [{"status": "affected", "version": "< 2.4.1"}]}]}], "published": "2026-10-12T21:17:21.753", "references": [{"url": "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2", "source": "security-advisories@github.com"}, {"url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6", "source": "security-advisories@github.com"}, {"url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1."}], "lastModified": "2026-10-13T18:17:25.927", "sourceIdentifier": "security-advisories@github.com"}