Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

{
  "id": "46ce8a02b3617eb47087fb7cef9150966e283dc8137aa66f1000e687571e457e",
  "url": "https://osv.dev/vulnerability/GHSA-2gc7-j998-5xx6",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint",
    "summary": "### Summary `POST /api/users/:id` allows any authenticated user to change any other user's password without `RequireSecureSession` (2FA verification). In contrast, the self password change endpoint `POST /api/user/password` correctly requires `RequireSecureSession`. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password. ### Details nginx-ui enforces `RequireSecureSession` middleware on sensitive operations such as self password change (`api/user/router.go:55`), self profile update (`api/user/router.go:54`), settings modification (`api/settings/router.go:12`), and config file deletion/rename (`api/config/router.go:16-21`). However, the user management endpoint registered in `InitManageUserRouter` (`api/user/user.go:31-68`) is mounted on the `g` router group (`router/routers.go:92`) which only applies `middleware.AuthRequired()` and `middleware.Proxy()` — **no `RequireSecureSession()`**. As a result, `POST /api/users/:id` with a `password` field in the JSON body updates the target user's password with only basic JWT authentication. No 2FA or secure session verification is performed, even if the target user has 2FA enabled. The attack flow: 1. Attacker authenticates as any user (e.g., user ID 2). 2. Attacker sends `POST /api/users/1` with `{\"password\": \"attacker-chosen\"}`. 3. Admin (user ID 1) password is changed. All existing admin tokens are invalidated (`api/user/user.go:48-49`). 4. Attacker logs i",
    "evidence": "osv:GHSA-2gc7-j998-5xx6",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260703131214-23d1934099b0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-2gc7-j998-5xx6",
      "aliases": [
        "CVE-2026-84314",
        "GHSA-2gc7-j998-5xx6",
        "GO-2026-6771"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.10-0.20260703131214-23d1934099b0"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2gc7-j998-5xx6/GHSA-2gc7-j998-5xx6.json"
          }
        }
      ],
      "modified": "2026-10-19T21:41:14.823819947Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84314",
        "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2",
        "https://github.com/0xJacky/nginx-ui",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-285"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-12T21:17:21Z",
        "github_reviewed_at": "2026-10-15T20:11:45Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84314",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 376788,
  "published_at": "2026-10-15T20:11:45+00:00"
}

{
  "id": "651ee1db5dd8adc509c5302f9e58a9e8f3cda2442c2254381a234288adf31e15",
  "url": "https://osv.dev/vulnerability/GO-2026-6771",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI",
    "summary": "Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint in github.com/0xJacky/Nginx-UI",
    "evidence": "osv:GO-2026-6771",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260703131214-23d1934099b0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6771",
      "aliases": [
        "CVE-2026-84314",
        "GHSA-2gc7-j998-5xx6",
        "GO-2026-6771"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.10-0.20260703131214-23d1934099b0"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6771.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-19T21:31:37.803275458Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84314",
        "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6771",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84314",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 376557,
  "published_at": "2026-10-19T21:08:35+00:00"
}