Improper Authorization in nginx-ui - #VU142585
Published: August 14, 2026
Vulnerability identifier: #VU142585
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to take over another user\'s account.
The vulnerability exists due to improper authorization in the POST /api/users/:id user management endpoint when handling authenticated password change requests. A remote user can send a crafted POST request with a password field for another user\'s account to take over another user\'s account.
No secure session or 2FA verification is performed on this endpoint, even if the target user has 2FA enabled.
Affected software
nginx-ui
Remediation
Install security update from vendor's website.
nginx-ui - update to 2.3.9