CVE-2026-79314: x-ui Privilege Escalation Vulnerability

CVE-2026-79314 Overview

CVE-2026-79314 is a horizontal privilege escalation vulnerability in x-ui version 0.3.2, an open-source multi-user Xray panel. Authenticated users can modify inbound proxy configurations belonging to other users by submitting requests that reference the target resource identifier. The update endpoint fails to validate that the referenced resource belongs to the requesting session user. Attackers can alter remarks, ports, protocols, settings, enabled state, expiry times, and traffic quotas on any other user's inbound configuration.

Critical Impact
Any authenticated x-ui user can tamper with other users' proxy inbound configurations, enabling service disruption, traffic redirection, and unauthorized changes to quotas and expiry dates.

Affected Products

x-ui version 0.3.2 (see the x-ui GitHub repository)
Multi-user Xray panel deployments exposing the inbound update endpoint
Deployments where multiple non-administrative users share the same x-ui instance

Discovery Timeline

2026-09-22 - CVE-2026-79314 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-79314

Vulnerability Analysis

The vulnerability resides in the inbound configuration update path of x-ui 0.3.2. The handler accepts a resource identifier from the request and applies the submitted changes to the matching database record. It does not cross-check the record's owner against the authenticated session's user identifier. Any authenticated user can therefore submit an update request referencing an inbound owned by a different account and modify its fields. The affected fields include remark, port, protocol, settings, enable, expiry_time, and traffic quota values.

This is a horizontal privilege escalation caused by broken object-level authorization. Because the update accepts arbitrary field values, an attacker can disable another user's proxy, change its listening port to cause collisions, alter protocol settings to break connectivity, or reset quotas and expiry dates.

Root Cause

The root cause is missing authorization on a per-object basis in the inbound update handler. The application authenticates the session but does not enforce ownership when performing writes against user-owned resources. This is a classic Insecure Direct Object Reference pattern in the multi-tenant data layer.

Attack Vector

Exploitation requires only a valid authenticated session on the x-ui panel. An attacker enumerates or guesses inbound identifiers belonging to other users and issues an update request through the panel's API. Because the server trusts the supplied identifier, the request succeeds regardless of ownership. Technical details are documented in the TraceLoom CVE-2026-79314 write-up.

No public exploit code is required beyond a normal browser session and modified request parameters. Refer to the linked advisory for the specific endpoint and request structure.

Detection Methods for CVE-2026-79314

Indicators of Compromise

Unexpected changes to inbound remark, port, protocol, enable, expiry_time, or traffic quota values in the x-ui database
Audit or web-server log entries showing inbound update requests where the authenticated user does not match the record owner
User reports of proxy inbounds becoming disabled, having modified ports, or exhibiting altered quotas without administrator action

Detection Strategies

Review the x-ui SQLite database (x-ui.db) for inbound records whose modification timestamps do not correlate with owner activity
Correlate HTTP access logs for POST requests to inbound update endpoints against session-to-user mappings and flag mismatches
Alert on bulk update activity from a single low-privilege user targeting multiple inbound identifiers in a short window

Monitoring Recommendations

Enable verbose access logging on the reverse proxy fronting x-ui and retain request bodies for update endpoints
Baseline normal per-user inbound modification frequency and alert on statistical deviations
Monitor for administrative actions originating from non-admin accounts using web application firewall or SIEM correlation

How to Mitigate CVE-2026-79314

Immediate Actions Required

Restrict panel access to trusted administrators only until an authorization fix is available
Audit existing inbound configurations against expected owner state and revert unauthorized changes
Rotate credentials for all non-administrative x-ui accounts to reduce the pool of authenticated attackers

Patch Information

No vendor patch is referenced in the NVD entry at publication. The upstream project is available at the x-ui GitHub repository; monitor the repository and any active forks for a security update addressing per-object authorization on inbound update endpoints.

Workarounds

Operate x-ui as a single-tenant instance and provision separate instances per user or tenant
Place the panel behind a reverse proxy that enforces per-user access controls on update endpoints
Disable multi-user accounts and use only the administrative account until an official fix ships

bash

# Example: restrict x-ui panel exposure to admin IPs at the reverse proxy layer
# nginx snippet
location /xui/ {
    allow 10.0.0.0/24;   # admin subnet
    deny  all;
    proxy_pass http://127.0.0.1:54321;
}