CVE-2026-102335Published
Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-102335 · Microsoft / collected KEV context
cve-program · CVE-2026-102335
- https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5749
- https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/user.js#L52-L62
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/templates/proxy_host.conf#L28
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/README.md#L36
- https://github.com/NginxProxyManager/nginx-proxy-manager
- https://www.vulncheck.com/advisories/nginx-proxy-manager-through-2.16.0-improper-authorization-via-advanced-config
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.