{"id":"CVE-2026-84314","kind":"vulnerability","aliases":["CVE-2026-84314","GHSA-2gc7-j998-5xx6","GO-2026-6771"],"related":[],"title":"Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.","summary":"Nginx UI, a web interface for managing Nginx, lets any logged-in user change another user's password through the user-management endpoint because it skips the secure-session step-up check. An attacker with any authenticated account can reset the administrator's password and log in as admin.","severity":"high","cvss":8.7,"epss":0.0033,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260703131214-23d1934099b0"],"affected":"< 1.9.10-0.20260703131214-23d1934099b0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx-ui","package","self-hosted"],"not_affected_if":["already-upgraded-to-2.4.1","single-trusted-user"],"how_to_check":"Check the installed Nginx UI version (Go module github.com/0xJacky/Nginx-UI) and compare it to the fixed version.","fix":"Upgrade Nginx UI to 2.4.1 or later (the Go module fix is 1.9.10-0.20260703131214-23d1934099b0).\nRotate administrator passwords and revoke existing admin tokens after upgrading if the instance was exposed to untrusted users.","status":"open","published_at":"2026-10-12T21:17:21+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:51:31+00:00","updated_at":"2026-10-23T19:51:31+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:51:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Nginx UI to 2.4.1 or later (the Go module fix is 1.9.10-0.20260703131214-23d1934099b0).\nRotate administrator passwords and revoke existing admin tokens after upgrading if the instance was exposed to untrusted users.","summary":"Nginx UI, a web interface for managing Nginx, lets any logged-in user change another user's password through the user-management endpoint because it skips the secure-session step-up check. An attacker with any authenticated account can reset the administrator's password and log in as admin.","category":"package","who_cares":["nginx-ui","self-hosted","go"],"confidence":0.8,"analyst_note":"Confirm the Go module version to release mapping and whether 2.4.1 corresponds to the listed pseudo-version; see https://pkg.go.dev/vuln/GO-2026-6771 and https://nvd.nist.gov/vuln/detail/CVE-2026-84314.","how_to_check":"Check the installed Nginx UI version (Go module github.com/0xJacky/Nginx-UI) and compare it to the fixed version.\nunknown","needs_analyst":true,"not_affected_if":["already-upgraded-to-2.4.1","single-trusted-user"],"severity_if_unknown":"high"},"cost_usd":0.000446,"input_tokens":2253,"output_tokens":442,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,25A,28A '-6771':26A '-84314':18A,29A '/0xjacky/nginx-ui':15A,32A '/api/users':111C '2.4.1':108C,174C '2gc7':21A '5xx6':23A 'account':3A,82B,150C 'admin':93B 'administr':86B,155C,160C,167C 'anoth':56B,123C 'attack':78B,146C 'authent':81B,119C,149C,164C 'chang':55B,122C,138C,152C 'check':76B 'cve':16A,27A 'endpoint':11A,65B,116C 'even':130C 'exist':159C 'fix':171C 'ghsa':20A 'ghsa-2gc7-j998-5xx6':19A 'github.com':14A,31A 'github.com/0xjacky/nginx-ui':13A,30A 'go':24A,33B 'host':40B 'id':112C 'initi':154C 'interfac':45B,100C 'invalid':158C 'issu':169C 'j998':22A 'let':49B 'log':52B,90B 'logged-in':51B 'manag':10A,47B,64B,115C 'miss':6A 'nginx':1A,35B,41B,48B,94C,103C 'nginx-ui':34B 'packag':37B 'pass':128C 'password':59B,88B,126C,137C,157C 'password-chang':136C 'path':139C 'permit':117C 'post':110C 'prior':106C 'requir':140C 'requiresecuresess':7A,129C 'reset':84B 'secur':71B 'secure-sess':70B 'self':39B,134C 'self-host':38B 'self-servic':133C 'server':105C 'servic':135C 'session':72B 'skip':68B 'step':74B,143C 'step-up':73B,142C 'takeov':4A 'though':131C 'token':161C 'ui':2A,36B,42B,95C 'user':9A,54B,57B,63B,99C,114C,120C,124C 'user-manag':62B,113C 'version':173C 'via':5A 'web':44B,98C,104C 'without':127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T21:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6771","url":"https://pkg.go.dev/vuln/GO-2026-6771","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-84314","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-84314","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-84314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84314","severity":null,"published_at":"2026-10-12T21:17:21+00:00","modified_at":"2026-10-13T18:17:25+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}