Ordinary authenticated users of Nginx UI between versions 2.0.0 and 2.5.0 can query the /api/nodes and /api/nodes/:id endpoints, which expose the node token field in the JSON response. The same token is accepted as an X-Node-Secret header by the AuthRequired mechanism, mapping the request to initUser and allowing the requesting user to impersonate a trusted node against a reachable cluster member. This lack of proper access controls therefore enables an attacker to perform privileged management operations, such as configuration synchronization or service restart, and potentially other sensitive actions that are only available to nodes or administrators.

0xJacky nginx-ui versions 2.0.0 through 2.4.x are affected; the issue was fixed in release v2.5.0.

The CVSS base score of 8.8 classifies this flaw as high severity, and the exploitability is non‑negligible for an authenticated user who can reach a cluster node. The EPSS score is not available, so the current likelihood of exploitation is uncertain, but the issue was not recorded in the CISA KEV catalog at the time of reporting, implying it is not a known actively exploited vulnerability. The attack vector is inferred to be internal or insider, requiring the attacker to possess ordinary user credentials and reach a cluster node that accepts the X-Node-Secret header. If successful, the attacker can impersonate a node with initUser privileges and execute privileged actions across the cluster.