CVE-2026-84314: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint
Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession (2FA verification). In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.
Details nginx-ui enforces RequireSecureSession middleware on sensitive operations such as self password change (api/user/router.go:55), self profile update (api/user/router.go:54), settings modification (api/settings/router.go:12), and config file deletion/rename (api/config/router.go:16-21).
However, the user management endpoint registered in InitManageUserRouter (api/user/user.go:31-68) is mounted on the g router group (router/routers.go:92) which only applies middleware.AuthRequired() and middleware.Proxy() — no RequireSecureSession().
As a result, POST /api/users/:id with a password field in the JSON body updates the target user's password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.
The attack flow:
1. Attacker authenticates as any user (e.g., user ID 2). 2. Attacker sends POST /api/users/1 with {"password": "attacker-chosen"}. 3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (api/user/user.go:48-49). 4. Attacker logs in as admin with the new password. 5. Admin is locked out.
PoC poc.zip
Please extract the uploaded compressed file before proceeding
1. docker compose up -d 2. python3 poc.py
<img width="501" height="55" alt="스크린샷 2026-04-22 오후 10 26 29" src="https://github.com/user-attachments/assets/6562ede2-7c11-48da-b905-be9964f4f7b1" />
Impact - Any authenticated user can change any other user's password, including the initial admin (user ID 1). - Full account takeover of the admin account.
Other sources
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/0xJacky/Nginx-UIto a version that resolves this vulnerability.Fixed in 1.9.10-0.20260703131214-23d1934099b0 - Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.4.1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Nginx UI user can exploit the affected user-management endpoint. The attacker does not need administrator privileges or user interaction.
What is the practical impact of exploitation?
An attacker can change the initial administrator's password, invalidate that administrator's existing tokens, and then log in as the administrator. This results in full compromise of the administrator account.
Which deployments are affected?
Nginx UI versions before 2.4.1 are affected. The issue concerns the POST /api/users/:id endpoint, which does not enforce RequireSecureSession for password changes.
What should teams do to remediate the issue?
Upgrade Nginx UI to version 2.4.1, which fixes the missing RequireSecureSession check. The provided data does not identify an alternative mitigation for deployments that cannot be upgraded immediately.