GHSA-2GC7-J998-5XX6 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Summary POST /api/users/:id allows any authenticated user to change any other user's password without RequireSecureSession 2FA verification. In contrast, the self password change endpoint POST /api/user/password correctly requires RequireSecureSession. This inconsistency enables any authenticated...

CVE-2026-84314

Nginx UI, a web user interface for the Nginx web server, is vulnerable to Account Takeover in versions prior to 2.4.1 . The POST /api/users/:id user-management endpoint fails to enforce the RequireSecureSession step-up, which is otherwise required for self-service password changes. An attacker wi...