SB2026071789 - Missing Authorization in nginx-ui

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to modify sensitive administrative settings and perform server control actions.

The vulnerability exists due to missing authorization in authenticated mutation routes outside the RequireSecureSession middleware when handling requests without a valid X-Secure-Session-ID secure-session token. A remote user can use a stolen or otherwise obtained authenticated session for a 2FA-enabled user to modify sensitive administrative settings and perform server control actions.

This affects OTP-enabled accounts because several sensitive routes are protected only by authenticated session checks and not by the application's short-lived step-up verification boundary.

Remediation

Install update from vendor's website.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-5v7c-xpfp-p65m
• https://github.com/0xJacky/nginx-ui/commit/4948fba8744e82c3d7003f68ee164e9f49421066