CVE-2026-84314

🗓️ 12 Oct 2026 20:47:51Reported by MendType

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-...

Reporter	Title	Published	Views	Family All 6
Circl	CVE-2026-84314	12 Oct 202620:53	–	circl
CVE	CVE-2026-84314	12 Oct 202620:47	–	cve
Cvelist	CVE-2026-84314 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint	12 Oct 202620:47	–	cvelist
EUVD	EUVD-2026-97862	12 Oct 202620:47	–	euvd
NVD	CVE-2026-84314	12 Oct 202621:17	–	nvd
Positive Technologies	PT-2026-110951	12 Oct 202600:00	–	ptsecurity

Vulners

Node

nginxui nginx_uiRange1.9.10-0.20260613100722-6053fa0d5488–1.9.10-0.20260703134738-0540f3ecf782

nginxui nginx_uiRange2.4.0–2.4.1

Source	Link
github	www.github.com/0xJacky/nginx-ui/security/advisories/GHSA-2gc7-j998-5xx6
github	www.github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2
github	www.github.com/0xJacky/nginx-ui/releases/tag/v2.4.1

13 Oct 2026 05:28Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

CVSS 3.18.8