CVE-2026-84314

Received Received - Intake

Authenticated Password Change in Nginx UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84314

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability affects Nginx UI versions prior to 2.4.1. An authenticated user can exploit the POST /api/users/:id endpoint to change another user's password without requiring a secure session. This allows an attacker with an account to reset the administrator's password, invalidate existing admin tokens, and gain administrator access.

Detection Guidance

Check if your Nginx UI version is prior to 2.4.1 by running: curl -s http://<nginx-ui-address>/api/version | grep version. If the version is below 2.4.1, the system is vulnerable.

Impact Analysis

If you use Nginx UI versions before 2.4.1, an attacker with any authenticated account could take over the administrator account. This grants full control over the Nginx UI, potentially allowing unauthorized changes to server configurations or access to sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, data breaches, and potential legal penalties due to inadequate access controls.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.1 or later immediately. Review user accounts for unauthorized changes and invalidate all administrator tokens after upgrade.

Hi! I’m here to help you understand CVE-2026-84314. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70