{"id":"EUVD-2026-97862","enisaUuid":"a02aed47-fe5a-376b-9573-31c86ebe81c5","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user\u0027s password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator\u0027s password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:47:51 PM","dateUpdated":"Oct 13, 2026, 5:32:02 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","aliases":"CVE-2026-84314\nGHSA-2gc7-j998-5xx6\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"7d0c8101-2d40-3b92-8efc-da555514e23d","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"enisaIdVendor":[{"id":"4fd34f8b-556d-3efe-9a7c-a287c6edf1bb","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"c16f4437-e9b2-3cf0-b230-1de641395013","vulnerability":{"id":"GHSA-2gc7-j998-5xx6","description":"Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint","datePublished":"Oct 15, 2026, 8:11:45 PM","dateUpdated":"Oct 15, 2026, 8:11:45 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-84314\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97862\n","aliases":"GHSA-2gc7-j998-5xx6\nCVE-2026-84314\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:48 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d89d353e-5962-3f4f-8c2c-f9ece2a4d0f7","vulnerability":{"id":"CVE-2026-84314","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user\u0027s password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator\u0027s password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.","datePublished":"Oct 12, 2026, 8:47:51 PM","dateUpdated":"Oct 13, 2026, 5:32:02 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6\nhttps://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1\n","enisa_id":"EUVD-2026-97862\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 3, 2026, 7:13:13 AM","vulnerabilityProduct":[{"id":"9630f3f2-eac9-36c0-aeb5-d69b7f608a13","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"\u003c 2.4.1"}],"vulnerabilityVendor":[{"id":"2f807f98-4d0c-3382-9e16-b2becf5317d3","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}