Missing Authorization in nginx-ui - #VU157113
Published: October 22, 2026
Vulnerability details
The vulnerability allows a remote user to change persistent log-indexing settings, destroy existing search indexes, and degrade log-search availability without completing the required secure-session step-up.
The vulnerability exists due to missing authorization checks in the nginx-log advanced-indexing and index-rebuild routes when handling settings changes and rebuild requests. A remote user can send requests with a valid JWT but no fresh secure-session verification to POST /api/nginx_log/settings/advanced_indexing/enable, POST /api/nginx_log/settings/advanced_indexing/disable, or POST /api/nginx_log/index/rebuild to change indexing settings or trigger a destructive rebuild. A rebuild request with an empty body destroys all existing search indexes before reindexing, consuming CPU, I/O, and disk resources.
The actions can also reach child cluster nodes through the proxy functionality.