CVE-2026-84314
|
| |
|
|
Affected software |
NGINX |
|
|
|
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up. An attacker with an authenticated account can change the initial administrator's password, invalidate existing administrator tokens, and then authenticate as the administrator. This issue is fixed in version 2.4.1. |
Link: |
| https://nvd.nist.gov/vuln/detail/CVE-2026-84314 |
