CVE-2026-79314: X-ui x-ui vulnerability
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated x-ui user can exploit it. The attacker must be able to submit an update request that references another user's inbound proxy resource identifier.
What can an attacker change in another user's configuration?
The attacker can modify the target user's inbound proxy remark, port, protocol, settings, enabled state, expiry time, and traffic quota.
Are unauthenticated deployments affected?
The described attack requires authentication. The available information does not indicate that an unauthenticated attacker can exploit this issue.