GHSA-2GC7-J998-5XX6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

Smartloli EFAK authorization issue vulnerability

SmartLoli EFAK versions 5.1.0 and earlier have an authorization issue. This vulnerability stems from the lack of a role check for the/api/users endpoint. Certified low-privilege users can manage their accounts by sending POST, PUT, or DELETE requests to the UserController. This allows them to gra...

CVE-2026-106700

ELADMIN v2.7 and earlier is affected by an improper access control vulnerability within the user-management endpoint PUT /api/users/resetPwd of the me.zhengjie.modules.system.rest.UserController component. The root cause is a missing method-level authorization check and a lack of role-level or ow...

EUVD-2026-102421

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs n...

CVE-2026-106700: Missing Authorization

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs n...

PT-2026-115212

ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs n...

eladmin authorization issue vulnerability

Eladmin versions 2.7 and earlier have an authorization issue. This vulnerability stems from the lack of method-level authorization checks in the user management endpoint PUT /api/users/resetPwd. Additionally, in UserServiceImpl.resetPwd, there is no role-level or ownership verification. This coul...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

EUVD-2026-100465

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-110130 Dockhand before 1.0.45 Authentication Bypass via Static-Asset Check

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

PT-2026-112035

Name of the Vulnerable Software and Affected Versions Dockhand versions prior to 1.0.45 Description An authentication bypass exists because the global auth hook ignores authentication for paths ending in static-asset extensions, such as .js, which includes routes under /api/. Additionally,...

CVE-2026-110130: Authentication Bypass Using an Alternate Path or Channel

Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/ routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers c...

CVE-2026-84314

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84314 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84314 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84314

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84314

Nginx UI, a web user interface for the Nginx web server, is vulnerable to Account Takeover in versions prior to 2.4.1 . The POST /api/users/:id user-management endpoint fails to enforce the RequireSecureSession step-up, which is otherwise required for self-service password changes. An attacker wi...