This flaw lets authenticated users retrieve the full settings payload via the GetSettings API; the code serializes all configuration fields to JSON without filtering protected ones. Vulnerable fields such as JwtSecret, NodeSecret, and OIDC ClientSecret can be extracted, enabling token forgery, cluster impersonation, or OAuth takeover. The weakness is a confidentiality breach (CWE-200).

The vulnerable component is nginx‑ui, version 2.3.7 and earlier, by the vendor 0xJacky. A patch was released in v2.3.8; any deployment using earlier releases is susceptible.

The CVSS score of 6.5 indicates a moderate severity; EPSS is not reported, and the vulnerability is not in CISA KEV. Attackers need only authenticated access to the web interface; the flaw is read‑oriented and does not require additional privileges. Exploitation would allow the attacker to exfiltrate secrets and compromise authentication mechanisms.