{"id":"EUVD-2026-97907","revision":"73775d4ba3e04d84a4b6c4010482fac4","records":[{"revision":"73775d4ba3e04d84a4b6c4010482fac4","observedAt":"2026-11-01T13:00:36.293+00:00","statement":{"source":"euvd","id":"EUVD-2026-97907","aliases":["CVE-2026-84360","GHSA-vc32-4gwf-77xp"],"title":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add …","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1,"severity":null}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-vc32-4gwf-77xp","https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2","https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97907","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 12, 2026, 9:08:04 PM","dateUpdated":"Oct 13, 2026, 2:00:35 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-97907","identifiers":["EUVD-2026-97907","CVE-2026-84360","GHSA-vc32-4gwf-77xp"]},"retained":false,"historicalAffected":[]}],"coverage":[]}