{"id":"GO-2026-6724","revision":"9062dfe7857441b0a9af0250c9c49cbf","records":[{"revision":"9062dfe7857441b0a9af0250c9c49cbf","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6724","aliases":["CVE-2026-107804","GHSA-9h23-53f4-q947"],"title":"Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI","description":"Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout in github.com/0xJacky/Nginx-UI.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: .","state":0,"publishedAt":"2026-10-19T21:08:26+00:00","modifiedAt":"2026-10-19T21:31:35.9618566+00:00","affected":[{"ecosystem":"Go","name":"github.com/0xJacky/Nginx-UI","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.10-0.20260904075558-e30e331303fc"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-9h23-53f4-q947","https://nvd.nist.gov/vuln/detail/CVE-2026-107804","https://github.com/0xJacky/nginx-ui/commit/e30e331303fc21cf077a2bea724bd79e66892eaf","https://github.com/0xJacky/nginx-ui/releases/tag/v2.6.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6724","license":"OSV · upstream source license applies","key":"osv:GO-2026-6724","identifiers":["GO-2026-6724","CVE-2026-107804","GHSA-9h23-53f4-q947"]},"retained":false,"historicalAffected":[]}],"coverage":[]}