CVE-2026-84314: CWE-285: Improper Authorization in 0xJacky nginx-ui
Description
A vulnerability in 0xJacky's nginx-ui prior to version 2.4.1 allows an authenticated user to change another user's password via the POST /api/users/:id endpoint without requiring a secure session. This flaw enables an attacker with any authenticated account to reset the initial administrator's password, invalidate administrator tokens, and gain administrator access. The issue is resolved in version 2.4.1.
CVSS v4.0
Score 8.7high
Affected software
0xJacky
nginx-ui
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The nginx-ui web interface for the Nginx web server contains an improper authorization vulnerability (CWE-285) in versions before 2.4.1. Specifically, the POST /api/users/:id endpoint permits authenticated users to change other users' passwords without enforcing the RequireSecureSession step-up that is required for self-service password changes. This allows an attacker with any authenticated account to reset the administrator password, invalidate existing administrator sessions, and authenticate as the administrator. The vulnerability has a CVSS 4.0 score of 8.7 (high severity) and is fixed in version 2.4.1.
Potential Impact
An attacker with any authenticated account can escalate privileges by changing the administrator's password, effectively taking over the administrator account. This compromises the integrity and control of the nginx-ui interface, allowing full administrative access and invalidating existing administrator tokens.
Mitigation Recommendations
Upgrade nginx-ui to version 2.4.1 or later, where this improper authorization vulnerability is fixed. No other mitigations are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:17:43.079Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd4b4a2cdf04f656d3ef81
Added to database: 10/12/2026, 21:04:10 UTC
Last enriched: 10/12/2026, 21:18:12 UTC
Last updated: 10/12/2026, 21:19:03 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.