The vulnerability is an Insecure Direct Object Reference that allows any authenticated user in a multi‑user environment to read, modify, or delete resources belonging to other users. It arises because the base model in Nginx UI does not include a user identifier, and each resource endpoint queries by ID alone without verifying ownership, enabling a complete authorization bypass. The result is a compromise of confidentiality, integrity, and availability of other users’ data. The weakness is classified as CWE‑639 and includes mention of CWE‑78, indicating potential unsafe system calls that could be influenced by attackers.

Nginx UI, a web user interface for the Nginx server released by 0xJacky, is affected for versions 2.3.3 and earlier. No other vendors or product versions are listed in the CVE entry, so only this product and version range are impacted.

The CVSS score of 8.8 marks the issue as high severity, but the EPSS score of less than 1% suggests a low probability that it is currently being exploited. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker first authenticate to the Nginx UI; once logged in, they can target arbitrary resource identifiers to access or alter other users’ data. No patch is publicly available at the time of publication, leaving the risk active until a fix is released.