Improper Authorization in nginx-ui - CVE-2026-84314
Published: August 14, 2026 / Updated: October 16, 2026
Vulnerability identifier: #VU142585
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84314
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to take over another user's account.
The vulnerability exists due to improper authorization in the POST /api/users/:id user management endpoint when handling authenticated password change requests. A remote user can send a crafted POST request with a password field for another user's account to take over another user's account.
No secure session or 2FA verification is performed on this endpoint, even if the target user has 2FA enabled.
Affected software
nginx-ui
How to mitigate CVE-2026-84314
Install security update from vendor's website.
nginx-ui - update to 2.3.9