Main
Vulnerability Database
Exploits
ID:12709 - Exploit for Missing Authentication for Critical Function in nginx-ui - CVE-2026-27944
ID:12709 - Exploit for Missing Authentication for Critical Function in nginx-ui - CVE-2026-27944
Published: May 15, 2026
Vulnerability identifier: #VU127228
Vulnerability risk: High
CVE-ID: CVE-2026-27944
CWE-ID: CWE-306
Exploitation vector: Remote access
Vulnerable software:
nginx-ui
nginx-ui
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to download and decrypt a full system backup containing sensitive information.
The vulnerability exists due to missing authentication for critical function in the /api/backup endpoint when handling unauthenticated backup requests. A remote attacker can send a crafted GET request to download and decrypt a full system backup containing sensitive information.
The AES-256 key and IV are disclosed in the X-Backup-Security response header, and the backup may contain user credentials, session tokens, SSL private keys, and nginx configuration data.
Remediation
Install security update from vendor's website.