{"id":"EUVD-2026-95898","enisaUuid":"64b64a02-54f9-3359-b056-d7ed245de5d2","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:47:33 PM","dateUpdated":"Oct 9, 2026, 5:16:22 PM","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h246-wpgf-vmq5\nhttps://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","aliases":"CVE-2026-107813\nGHSA-h246-wpgf-vmq5\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"04d050b6-d0de-3994-9520-8e2191351bbd","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"enisaIdVendor":[{"id":"a2c6ede5-a2c8-38fc-84b6-36bcd9af931f","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"81d76099-7527-379b-a7ca-3af879612630","vulnerability":{"id":"GHSA-h246-wpgf-vmq5","description":"Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not -  wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up","datePublished":"Oct 9, 2026, 5:08:06 PM","dateUpdated":"Oct 9, 2026, 5:08:06 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h246-wpgf-vmq5\nhttps://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95898\n","aliases":"GHSA-h246-wpgf-vmq5\nCVE-2026-107813\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a65e2eb6-0884-394a-ad6b-8ae207e26ba0","vulnerability":{"id":"CVE-2026-107813","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and cluster-wide Nginx reload or restart operations with AuthRequired but without RequireSecureSession. An authenticated OTP-enabled user possessing a stolen or persisted JWT can therefore perform node CRUD, read or replace node credentials, change namespaces, and invoke nodes/reload_nginx or nodes/restart_nginx without a fresh second-factor step-up. This issue is an incomplete fix for CVE-2026-84315 and is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:47:33 PM","dateUpdated":"Oct 9, 2026, 5:16:22 PM","status":"PUBLISHED","baseScore":8.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-h246-wpgf-vmq5\nhttps://github.com/0xJacky/nginx-ui/commit/a3999bd78a3b97ab22e6b5e9fd478ac57598a954\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95898\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 1, 2026, 4:04:46 AM","vulnerabilityProduct":[{"id":"13b282ec-e931-3251-9df2-9b41ad81dc49","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"vulnerabilityVendor":[{"id":"3d2b535b-0c1b-3bd3-934c-386bb56527f1","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}