Prior to version 2.3.8, any authenticated user of nginx‑ui can call the endpoint /api/settings and receive sensitive configuration values, such as the node.secret. That same secret is also accepted by the X‑Node‑Secret header or node_secret query parameter used by the trusted‑node authentication mechanism, allowing an attacker to impersonate the init user and gain full privileged access. The vulnerability therefore exposes confidential configuration data and enables privilege escalation to the highest level within the application.

The affected product is nginx‑ui distributed by 0xJacky. All releases prior to v2.3.8 are vulnerable. Users should verify that their installation is upgraded to version 2.3.8 or newer to eliminate the flaw.

The CVSS score of 6.5 indicates a moderate severity. External Exploit Probability is not available, and the vulnerability is not listed in the CISA KEV catalog. Because any authenticated user can invoke the vulnerable endpoint, the attack vector is likely local or authenticated remote, depending on the compromise state of the web application. Exploitation requires only legitimate credentials; once the node.secret is retrieved, the attacker can authenticate as the init user via the trusted‑node path.