In x-ui 0.3.2, an authenticated user can exploit a horizontal privilege escalation vulnerability by submitting a request that references another user's inbound proxy configuration resource identifier. The update path lacks verification that the target resource belongs to the requesting user, allowing modification of parameters such as remark, port, protocol, settings, enabled state, expiry time, and traffic quota for other users' configurations.

An attacker with valid authentication credentials can alter proxy configurations of other users, potentially disrupting service or manipulating traffic quotas and settings. This unauthorized modification could affect user data integrity and service availability for impacted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users and monitor for suspicious modification attempts related to inbound proxy configurations.