CVE-2026-107809: CWE-352: Cross-Site Request Forgery (CSRF) in 0xJacky nginx-ui

The nginx-ui web interface for Nginx versions >=2.0.0 and <2.5.0 accepts a browser-managed token cookie as an API credential. Management endpoints do not universally enforce CSRF tokens or validate Origin or Referer headers, enabling a remote attacker to coerce an authenticated administrator's browser into submitting cross-site requests that change server state, such as POST /api/configs. The attack requires the administrator to be logged in without multi-factor authentication or targeting endpoints that do not require secure-session proof. While the attacker cannot read the responses, they can modify configurations, trigger reloads, or invoke other management operations within the victim's session context. This vulnerability is addressed in version 2.5.0.

An attacker can perform unauthorized state-changing actions on the nginx-ui management interface by exploiting the CSRF vulnerability, potentially modifying Nginx configurations, triggering reloads, or executing other administrative operations. Confidentiality is not directly impacted as the attacker cannot read responses, but integrity and availability of the Nginx service can be severely affected.

Upgrade nginx-ui to version 2.5.0 or later, where this CSRF vulnerability is fixed. Until then, ensure administrators use multi-factor authentication methods such as OTP or Passkey, and restrict access to management endpoints to trusted networks or users. Patch status is confirmed fixed in version 2.5.0.