CVE-2026-79316: X-ui vulnerability
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated x-ui panel user can exploit it. The described action is performed through the settings interface and does not require direct local access to the host.
What attacker access is required to expose the management service beyond loopback?
The attacker needs an authenticated panel account with access to modify the xray configuration template through x-ui settings and trigger a panel restart.
Is the default management-service binding directly exposed?
No. The management gRPC service is bound to loopback by default; exposure occurs after an authenticated user changes the template and restarts the panel, causing it to be regenerated with non-loopback bindings.