Threats affecting pkg:github/vaxilu/x-ui

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.

CVE-2026-79316 is an improper access control vulnerability in x-ui version 0.3.2. Authenticated panel users can modify the xray configuration template via the settings interface and trigger a panel restart. This causes the xray management gRPC service, normally bound to loopback addresses only, to be rebound to non-loopback addresses, expanding its network exposure beyond the intended local-only boundary.

CVE-2026-79317 is a session invalidation vulnerability in x-ui version 0.3.2. The application stores the full user object in a client-side signed cookie and only verifies the presence of this cookie without revalidating the session against the database or session version. This flaw allows an attacker holding a pre-change administrator cookie to maintain access to the management interface even after the administrator changes their username or password.