An authenticated user of the x-ui 0.3.2 web panel can change the xray configuration templates. By doing so the software can regenerate the xray gRPC management service and bind it to non-loopback addresses. The service is meant to be accessible only from the host, so this configuration change expands the reachable surface and exposes the management endpoint to the broader network.

The affected product is the x-ui management interface, version 0.3.2. No other vendor or product version is listed in the CNA data. Clients running this version should verify their installation and whether the vulnerable configuration change is possible.

Because the attack requires authentication to a web panel, the risk of exploitation depends on the strength of those credentials. Once the gRPC service is exposed, an attacker can remotely issue management requests that could alter xray's behavior or leak internal data. The CVSS score of 7.6 indicates a medium‑to‑high severity, while the EPSS score of <1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, further indicating limited public exploitation. However, the potential for remote access to a normally local management interface remains a high‑impact exposure that should be addressed promptly.