CVE-2026-84314: Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

October 15, 2026

POST /api/users/:id allows any authenticated user to change any other user’s password without RequireSecureSession (2FA verification). In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated user to take over the initial admin account (user ID 1) by simply changing its password.

References

github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
github.com/0xJacky/nginx-ui/releases/tag/v2.4.1
github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6
github.com/advisories/GHSA-2gc7-j998-5xx6
nvd.nist.gov/vuln/detail/CVE-2026-84314

Code Behaviors & Features

Detect and mitigate CVE-2026-84314 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →