SB20260814128 - Improper Authorization in nginx-ui

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260814128

SB20260814128 - Improper Authorization in nginx-ui

Published: August 14, 2026

Security Bulletin ID SB20260814128
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to take over another user\'s account.

The vulnerability exists due to improper authorization in the POST /api/users/:id user management endpoint when handling authenticated password change requests. A remote user can send a crafted POST request with a password field for another user\'s account to take over another user\'s account.

No secure session or 2FA verification is performed on this endpoint, even if the target user has 2FA enabled.


Remediation

Install update from vendor's website.

References