GHSA-2gc7-j998-5xx6: Go/github.com/0xJacky/Nginx-UI vulnerability
Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession (2FA verification). In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.
Details nginx-ui enforces RequireSecureSession middleware on sensitive operations such as self password change (api/user/router.go:55), self profile update (api/user/router.go:54), settings modification (api/settings/router.go:12), and config file deletion/rename (api/config/router.go:16-21).
However, the user management endpoint registered in InitManageUserRouter (api/user/user.go:31-68) is mounted on the g router group (router/routers.go:92) which only applies middleware.AuthRequired() and middleware.Proxy() — no RequireSecureSession().
As a result, POST /api/users/:id with a password field in the JSON body updates the target user's password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled.
The attack flow:
1. Attacker authenticates as any user (e.g., user ID 2). 2. Attacker sends POST /api/users/1 with {"password": "attacker-chosen"}. 3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (api/user/user.go:48-49). 4. Attacker logs in as admin with the new password. 5. Admin is locked out.
PoC poc.zip
Please extract the uploaded compressed file before proceeding
1. docker compose up -d 2. python3 poc.py
<img width="501" height="55" alt="스크린샷 2026-04-22 오후 10 26 29" src="https://github.com/user-attachments/assets/6562ede2-7c11-48da-b905-be9964f4f7b1" />
Impact - Any authenticated user can change any other user's password, including the initial admin (user ID 1). - Full account takeover of the admin account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/0xJacky/Nginx-UIto a version that resolves this vulnerability.Fixed in 1.9.10-0.20260703131214-23d1934099b0 - Configuration
Mount the user management endpoint on a router group that applies RequireSecureSession, so changing another user's password requires secure-session/2FA verification.
nginx-ui user management endpoint POST /api/users/:id RequireSecureSession middleware = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated nginx-ui user with a valid JWT can invoke the user-management endpoint. The issue does not require the attacker to complete 2FA or otherwise establish a secure session.
What access can an attacker gain?
An authenticated user can submit a password field to POST /api/users/:id and change another user's password, including the initial administrator account with user ID 1. This can allow the attacker to take over that account.
Are 2FA-protected deployments still affected?
Yes. Although nginx-ui applies RequireSecureSession to several sensitive self-service and administrative operations, the affected user-management route only applies authentication and proxy middleware, not RequireSecureSession.
How can I identify potentially affected activity?
Review requests to POST /api/users/:id, particularly requests containing a password field and targeting privileged accounts such as user ID 1. The available information does not provide additional logging indicators or a method to determine whether exploitation occurred.