CVE-2026-84314: Nginx UI Authentication Bypass Vulnerability

CVE-2026-84314 Overview

CVE-2026-84314 is a broken authorization vulnerability in Nginx UI, a web user interface for the Nginx web server. The POST /api/users/:id user-management endpoint fails to enforce the RequireSecureSession middleware when an authenticated user changes another user's password. The self-service password-change path correctly requires this step-up authentication, but the administrative path does not. An attacker with any authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. The flaw is tracked under [CWE-285: Improper Authorization] and is fixed in Nginx UI version 2.4.1.

Critical Impact

Any authenticated low-privilege user can take over the administrator account by overwriting its password through the user-management endpoint, resulting in full compromise of the Nginx UI instance.

Affected Products

• Nginx UI versions prior to 2.4.1
• Nginx UI deployments exposing /api/users/:id to authenticated users
• Multi-user Nginx UI installations where non-administrator accounts exist

Discovery Timeline

• 2026-10-12 - CVE-2026-84314 published to the National Vulnerability Database
• 2026-10-13 - Last updated in NVD database
• GitHub Security Advisory - Published as GHSA-2gc7-j998-5xx6
• Patch Release - Fix shipped in Nginx UI v2.4.1

Technical Details for CVE-2026-84314

Vulnerability Analysis

Nginx UI implements a step-up authentication mechanism through a middleware named RequireSecureSession. This middleware forces users to re-authenticate before performing sensitive actions. The self-service password-change endpoint correctly invokes this middleware. However, the administrative user-management endpoint at POST /api/users/:id omits the step-up check. The endpoint relies only on standard session authentication through AuthRequired. An authenticated non-administrator user can therefore submit a password change for any other account, including the first administrator. Once the administrator password is overwritten, existing administrator session tokens are invalidated and the attacker authenticates with the new credentials.

Root Cause

The root cause is an authorization gap between two routes that modify the same resource. The self-service flow enforces RequireSecureSession, but the administrative flow does not. The patch extends the hardened middleware chain to additional sensitive routes across backup, certificate, and user-management handlers. The affected handler lacked both a role check and the step-up session requirement, allowing any authenticated principal to act on another user's credentials.

Attack Vector

Exploitation requires network access to the Nginx UI API and valid credentials for any account on the instance. The attacker sends a crafted POST request to /api/users/:id targeting the administrator user ID with a new password in the request body. No user interaction is required. After the response, the attacker authenticates with the chosen password and inherits full administrator privileges, which include control over Nginx configuration, certificates, and backups.

// Source: https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
// Patch: api/backup/router.go — add RequireSecureSession to backup route
func InitRouter(r *gin.RouterGroup) {
-    r.GET("/backup", middleware.AuthRequired(), CreateBackup)
+    r.GET("/backup", middleware.AuthRequired(), middleware.RequireSecureSession(), CreateBackup)
     r.POST("/restore", middleware.AuthRequired(), middleware.RequireSecureSession(), middleware.EncryptedForm(), RestoreBackup)
}

// Source: https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
// Patch: api/certificate/router.go — group sensitive routes under RequireSecureSession
func InitDNSCredentialRouter(r *gin.RouterGroup) {
    r.GET("dns_credentials", GetDnsCredentialList)
    r.GET("dns_credentials/:id", GetDnsCredential)
-   r.POST("dns_credentials", AddDnsCredential)
-   r.POST("dns_credentials/:id", EditDnsCredential)
-   r.DELETE("dns_credentials/:id", DeleteDnsCredential)
+   o := r.Group("", middleware.RequireSecureSession())
+   {
+       o.POST("dns_credentials", AddDnsCredential)
+       o.POST("dns_credentials/:id", EditDnsCredential)
+       o.DELETE("dns_credentials/:id", DeleteDnsCredential)
+   }
}

Detection Methods for CVE-2026-84314

Indicators of Compromise

• Unexpected POST /api/users/:id requests originating from non-administrator session tokens targeting administrator user IDs
• Administrator session token invalidation events immediately followed by a successful login from an unusual IP or client
• Modifications to Nginx configurations, TLS certificates, or DNS credentials performed shortly after an unexplained administrator re-authentication

Detection Strategies

• Correlate HTTP access logs for /api/users/ POST calls with the authenticated user ID and the target user ID; alert when they differ and the target is privileged
• Monitor Nginx UI audit logs for password-change events on administrator accounts that did not originate from the account owner
• Baseline normal administrator login sources and flag new user-agents or geographies that appear immediately after a password reset

Monitoring Recommendations

• Forward Nginx UI application logs and reverse-proxy access logs to a centralized log platform for retention and query
• Create alerts on sequential events: user-management API call, administrator session revocation, successful administrator login
• Review account provisioning records to identify any low-privilege accounts created shortly before suspicious administrator activity

How to Mitigate CVE-2026-84314

Immediate Actions Required

• Upgrade Nginx UI to version 2.4.1 or later without delay
• Rotate the administrator password and any API tokens issued by the Nginx UI instance
• Audit the users table for accounts created by unknown principals and remove any that are not expected
• Restrict network exposure of the Nginx UI management interface to trusted administrative networks or a VPN

Patch Information

The fix is available in Nginx UI v2.4.1. The maintainer committed the hardening in commit 23d1934, which adds the RequireSecureSession middleware to the user-management, backup, certificate, and DNS credential routes. Full details are in the GHSA-2gc7-j998-5xx6 advisory.

Workarounds

• Place Nginx UI behind a reverse proxy that enforces client certificate authentication or IP allow-listing until the patch is applied
• Disable creation of non-administrator user accounts to shrink the pool of principals able to invoke the vulnerable endpoint
• Monitor and rate-limit the /api/users/ path at the reverse proxy and alert on any POST request to that path

# Example reverse-proxy restriction for the Nginx UI management API
location /api/users/ {
    allow 10.0.0.0/24;        # trusted admin subnet
    deny all;
    proxy_pass http://127.0.0.1:9000;
}