CVE-2026-79314
Received Received - Intake

Horizontal Privilege Escalation in x-ui 0.3.2

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-79314
EUVD
EUVD-2026-84491

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
lichoin x-ui 0.3.2
lichoin x-ui From 0.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a horizontal privilege escalation in x-ui 0.3.2 where an authenticated user can modify or delete inbound proxy configurations belonging to other users by referencing their resource identifier. The system fails to verify ownership of the target resource during updates or deletions, allowing unauthorized cross-user data changes.

Detection Guidance

To detect this vulnerability, monitor for unauthorized modifications to inbound proxy configurations in x-ui 0.3.2. Check logs for requests referencing resource identifiers not belonging to the authenticated user. Look for unexpected deletions or changes to proxy settings, ports, or protocols.

Impact Analysis

An attacker with access could modify or delete another user's proxy configurations, causing service disruption, data loss, or unauthorized access. This requires an authenticated account and knowledge of the target record's identifier.

Compliance Impact

This vulnerability could lead to unauthorized data access or destruction, violating confidentiality and availability requirements in GDPR and HIPAA. Organizations using x-ui may face compliance violations if exploited.

Mitigation Strategies

Immediately restrict access to x-ui instances running version 0.3.2. Implement temporary ownership validation checks in the code to prevent cross-user modifications. Monitor for suspicious activity and prepare to upgrade once a patched version is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart