{"id":"CVE-2026-107809","kind":"vulnerability","aliases":["CVE-2026-107809","GHSA-33rr-wq23-g6gg","GO-2026-6703"],"related":[],"title":"Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs. The attack requires an administrator account without OTP/Passkey or a target endpoint that does not require secure-session proof. The attacker cannot read the cross-origin response but can modify Nginx configuration, trigger reloads, or invoke other management operations reachable with the victim's session. This issue is fixed in version 2.5.0.","summary":"Nginx-UI, a web management interface for Nginx, accepts the browser-stored JWT cookie as an API credential and lacks consistent CSRF or Origin checks on management endpoints. A remote attacker who lures a logged-in administrator to a malicious page can make the victim's browser change Nginx configuration, trigger reloads, or run other management actions.","severity":"high","cvss":8.8,"epss":0.00193,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728074433-a3999bd78a3b"],"affected":">= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074433-a3999bd78a3b","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["auth-required","managed-hosting","no-admin-browser-sessions"],"how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod; unknown whether the sources give a runtime command.\nAffected range per govuln: >= 1.9.10-0.20250517140552-daee3ac7ade1 and < 1.9.10-0.20260728074433-a3999bd78a3b.\nDescription says versions 2.0.0 through 2.5.0 are affected, which conflicts with the module pseudo-version range.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later (description says 2.5.0).\nUntil upgraded, restrict admin sessions and avoid browsing other sites while logged in to the management UI; unknown whether a configuration workaround exists.","status":"open","published_at":"2026-10-09T16:17:25+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:35+00:00","updated_at":"2026-10-23T19:52:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T19:52:35Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074433-a3999bd78a3b or later (description says 2.5.0).\nUntil upgraded, restrict admin sessions and avoid browsing other sites while logged in to the management UI; unknown whether a configuration workaround exists.","summary":"Nginx-UI, a web management interface for Nginx, accepts the browser-stored JWT cookie as an API credential and lacks consistent CSRF or Origin checks on management endpoints. A remote attacker who lures a logged-in administrator to a malicious page can make the victim's browser change Nginx configuration, trigger reloads, or run other management actions.","category":"package","who_cares":["nginx-ui","go","self-hosted","nginx"],"confidence":0.6,"analyst_note":"Sources conflict on affected versions (description 2.0.0-2.5.0 vs module pseudo-version range); confirm against https://pkg.go.dev/vuln/GO-2026-6703 and https://nvd.nist.gov/vuln/detail/CVE-2026-107809 and list which endpoints lack CSRF checks.","how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod; unknown whether the sources give a runtime command.\nAffected range per govuln: >= 1.9.10-0.20250517140552-daee3ac7ade1 and < 1.9.10-0.20260728074433-a3999bd78a3b.\nDescription says versions 2.0.0 through 2.5.0 are affected, which conflicts with the module pseudo-version range.","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required","no-admin-browser-sessions"],"severity_if_unknown":"high"},"cost_usd":0.000549,"input_tokens":2383,"output_tokens":621,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107809':19A,30A '-2026':18A,26A,29A '-6703':27A '/0xjacky/nginx-ui':16A,33A '/api/configs':181C '2.0.0':116C '2.5.0':118C,235C '33rr':22A 'accept':52B,120C 'account':187C 'action':102B 'administr':82B,166C,186C 'api':12A,61B,129C 'attack':75B,159C,183C,203C 'authent':171C 'authrequir':4A,119C 'browser':55B,92B,123C,168C 'browser-manag':122C 'browser-stor':54B 'cannot':204C 'chang':93B,177C 'check':69B 'configur':95B,215C 'consist':65B 'cooki':6A,58B,126C,140C 'credenti':62B,130C 'cross':173C,208C 'cross-origin':207C 'cross-sit':172C 'csrf':9A,66B,149C 'cve':17A,28A 'enabl':8A 'end':134C 'endpoint':72B,143C,193C 'fallback':7A 'fix':232C 'front':133C 'g6gg':24A 'ghsa':21A 'ghsa-33rr-wq23-g6gg':20A 'github.com':15A,32A 'github.com/0xjacky/nginx-ui':14A,31A 'go':25A,34B 'host':42B 'includ':179C 'induc':161C 'interfac':49B,109C 'invok':219C 'issu':230C 'jwt':57B,137C 'lack':64B 'log':80B,164C 'logged-in':79B,163C 'lure':77B 'make':88B 'malici':85B 'manag':11A,48B,71B,101B,124C,142C,221C 'modifi':213C 'nginx':2A,35B,37B,44B,51B,94B,103C,112C,214C 'nginx-ui':1A,36B,43B 'oper':222C 'origin':68B,153C,209C 'otp/passkey':189C 'packag':39B 'page':86B 'perform':152C 'post':180C 'proof':201C 'reachabl':223C 'read':205C 'refer':155C 'reload':97B,217C 'remot':74B,158C 'request':178C 'requir':147C,184C,197C 'respons':210C 'run':99B 'secur':199C 'secure-sess':198C 'self':41B 'self-host':40B 'server':114C 'session':200C,228C 'site':174C 'state':176C 'state-chang':175C 'store':56B,135C 'submit':170C 'target':192C 'token':5A,125C,150C 'trigger':96B,216C 'ui':3A,38B,45B,104C 'univers':146C 'user':108C 'valid':156C 'version':234C 'victim':90B,226C 'web':47B,107C,113C 'without':188C 'wq23':23A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T16:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6703","url":"https://pkg.go.dev/vuln/GO-2026-6703","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107809","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107809","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107809","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107809","severity":null,"published_at":"2026-10-09T16:17:25+00:00","modified_at":"2026-10-20T15:15:58+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}