Threats tagged 'ghsa-2gc7-j998-5xx6'

CVE-2026-84314 is an improper authorization vulnerability in 0xJacky's nginx-ui that allows any authenticated user to change any other user's password without requiring two-factor authentication (2FA). The vulnerable endpoint POST /api/users/:id lacks the RequireSecureSession middleware, unlike other sensitive operations that enforce 2FA. This flaw enables an attacker to take over the initial admin account by changing its password, effectively locking out the legitimate admin user.