Nginx Proxy Manager through version 2.16.0 contains an improper authorization flaw that allows a user with manage permissions to set the advanced_config field. By injecting arbitrary nginx directives into this field, the attacker can alter server configuration, expose sensitive files through alias directives, or redirect traffic for hosts they manage. The flaw is a classic authorization bypass (CWE‑863) and can lead to confidentiality, integrity, and availability violations.

The affected product is Nginx Proxy Manager from the NginxProxyManager organization, in all releases up to and including 2.16.0. Both the backend and frontend components of the application are impacted, as the advanced_config field is exposed and not protected for non‑administrator users.

The CVSS base score of 7.1 indicates a high impact and moderate exploitability. EPSS is not listed, so known exploitation prevalence is uncertain. The vulnerability is not yet cataloged in CISA KEV, but attackers can exploit it by authenticating as a non‑admin user with manage rights and sending a request that includes malicious directives; no additional privileges are required beyond those permissions.