{"id":"EUVD-2026-95895","enisaUuid":"168e50e0-b771-3720-abc4-7778c4da547a","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:36:18 PM","dateUpdated":"Oct 14, 2026, 1:57:18 AM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9\nhttps://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","aliases":"CVE-2026-107811\nGHSA-32gc-wf3m-78w9\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"81b51e57-737b-3ba3-9c46-e69f9a724e8d","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"enisaIdVendor":[{"id":"506d0569-1933-3738-bcf5-48615435ee73","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"8035b45f-5d53-3e86-bf45-911ef7ea0942","vulnerability":{"id":"GHSA-32gc-wf3m-78w9","description":"0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser","datePublished":"Oct 9, 2026, 5:07:23 PM","dateUpdated":"Oct 9, 2026, 5:07:23 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9\nhttps://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95895\n","aliases":"GHSA-32gc-wf3m-78w9\nCVE-2026-107811\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"97cedb3f-90dd-3abc-a533-6829668f32e8","vulnerability":{"id":"CVE-2026-107811","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id, whose responses serialize the node token field. The same token is accepted as X-Node-Secret by AuthRequired and maps the request to initUser, allowing the user to impersonate a trusted node against a reachable cluster member. This cross-node authentication bypass can expose sensitive management operations, including configuration synchronization and service restart. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:36:18 PM","dateUpdated":"Oct 14, 2026, 1:57:18 AM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-32gc-wf3m-78w9\nhttps://github.com/0xJacky/nginx-ui/commit/0ecbd106c37b5143be14880c9447a66135151512\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95895\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Nov 6, 2026, 7:17:35 AM","vulnerabilityProduct":[{"id":"d1bdca64-fd1e-3084-896a-37aad1318b9f","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"vulnerabilityVendor":[{"id":"f77449b5-c1b2-320a-9a5b-de6ee362f279","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}