Nginx UI: Account takeover via missing secure session check in user management
Summary
Nginx UI, a web interface for the Nginx web server, does not enforce the RequireSecureSession step-up check on the user-management endpoint POST /api/users/:id, although the self-service password change requires it. An authenticated user with a low-privilege account can change the initial administrator's password, invalidate existing administrator tokens and then log in as the administrator. Exploitation requires network access to the Nginx UI interface and a valid user account.
Affected
- Nginx UI versions before 2.4.1 (CVSS 4.0 range: < 2.4.1)
Fixed in
- Fixed in version 2.4.1 (fix commit 23d1934099b05b2a01589b48129dc3d3159d91c2).
- Newer releases (2.5.x) are available and should be preferred.
Workaround
- No vendor workaround known. Upgrading is the recommended fix.
- Interim measure: restrict access to the Nginx UI administration interface to management networks or a VPN, and remove unused user accounts.
Exploitation
- No confirmed exploitation in the wild known.
- CISA SSVC: exploitation status 'poc', not automatable.
- No public proof-of-concept found in the research; a market price estimate exists but is not evidence of a public exploit.
Our recommendation
- Update Nginx UI to version 2.4.1 or later, preferably the latest 2.5.x release.
- Check the Nginx UI version on all hosts, especially any internet-facing instances.
- Review the administrator account's password-change history and login logs for unexpected changes.
- If compromise is suspected, invalidate sessions by replacing the JwtSecret and restarting Nginx UI.
- Restrict access to the admin interface to management networks or a VPN and remove unused user accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2gc7-j998-5xx6 github.com
- Nginx UI release v2.4.1 github.com
- Fix commit 23d1934099b05b2a01589b48129dc3d3159d91c2 github.com
- OSV: CVE-2026-84314 osv.dev
- GitLab Advisory Database: CVE-2026-84314 advisories.gitlab.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:42.
Original description (NVD)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.