Most recent entries from all

bdu:2026-04702

2026-10-03T11:27:33.690826+00:00

bdu:2026-04702

EUVD-2026-278370

2026-10-03T11:27:33.690856+00:00

EUVD-2026-278370

fkie_cve-2026-33030

2026-10-03T11:27:33.690871+00:00

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.

GHSA-5hf2-vhj6-gj9m — nginx-UI has Unencrypted Storage of DNS API Tokens and ACME Private Keys

2026-10-03T11:27:33.690901+00:00

Affected: Go: github.com/0xJacky/nginx-ui

## Summary

Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base `Model` struct lacks a `user_id` field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments.

## Severity

**High** - CVSS 3.1 Score: **8.8 (High)**

Vector String: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`

**Note**: Original score was 7.5. The score was updated to 8.8 after discovering that sensitive data (DNS API tokens, ACME private keys) is stored in plaintext, which when combined with IDOR allows immediate credential theft without decryption.

## Product

nginx-ui

## Affected Versions

All versions up to and including v2.3.3

## CWE

CWE-639: Authorization Bypass Through User-Controlled Key

## Description

### Exposed DNS Provider Credentials

The `dns.Config` structure (`internal/cert/dns/config_env.go`) contains API credentials:

```go type Configuration struct { Credentials map[string]string `json:"credentials"` // API tokens here Additional map[string]string `json:"additional"` } ```

| Provider | Credential Fields | Impact if Leaked | |----------|------------------|------------------| | Cloudflare | `CF_API_TOKEN` | Full DNS zone control | | Alibaba Cloud DNS | `ALICLOUD_ACCESS_KEY`, `ALICLOUD_SECRET_KEY` | Full DNS control + potential IAM acces…

WID-SEC-W-2026-0931 — nginx-ui: Mehrere Schwachstellen

2026-10-03T11:27:33.690983+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um sich Administratorrechte zu verschaffen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand herbeizuführen.