CVE-2026-84314: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Q: Who can exploit this issue?

Any authenticated Nginx UI user can exploit the affected user-management endpoint. The attacker does not need administrator privileges or user interaction.

Q: What is the practical impact of exploitation?

An attacker can change the initial administrator's password, invalidate that administrator's existing tokens, and then log in as the administrator. This results in full compromise of the administrator account.

Q: Which deployments are affected?

Nginx UI versions before 2.4.1 are affected. The issue concerns the POST /api/users/:id endpoint, which does not enforce RequireSecureSession for password changes.

Q: What should teams do to remediate the issue?

Upgrade Nginx UI to version 2.4.1, which fixes the missing RequireSecureSession check. The provided data does not identify an alternative mitigation for deployments that cannot be upgraded immediately.

Published Oct 12, 2026

Updated

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.

Affected Software

1 affected component

Nginx UI Nginx UI<2.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Nginx UI to a version that resolves this vulnerability.
Fixed in 2.4.1

Event History

Oct 12, 2026

CVE Published

via MITRE·08:47 PM

Data Sourced

via MITRE·08:47 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Nginx UI user can exploit the affected user-management endpoint. The attacker does not need administrator privileges or user interaction.

What is the practical impact of exploitation?

An attacker can change the initial administrator's password, invalidate that administrator's existing tokens, and then log in as the administrator. This results in full compromise of the administrator account.

Which deployments are affected?

Nginx UI versions before 2.4.1 are affected. The issue concerns the POST /api/users/:id endpoint, which does not enforce RequireSecureSession for password changes.

What should teams do to remediate the issue?

Upgrade Nginx UI to version 2.4.1, which fixes the missing RequireSecureSession check. The provided data does not identify an alternative mitigation for deployments that cannot be upgraded immediately.

CVE-2026-84314: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Which deployments are affected?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

Which deployments are affected?

What should teams do to remediate the issue?