High
Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
Announced Group revision 1
Original source ↗CVE-2026-102335
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102335
nginx-proxy-manager
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/NginxProxyManager/nginx-proxy-manager",
"vendor": "NginxProxyManager",
"product": "nginx-proxy-manager",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "2.16.0"
}
],
"packageURL": "pkg:github/NginxProxyManager/nginx-proxy-manager",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-102335
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4392 · Revision 1
- Added to Heist Feed
- Publisher date