Nginx UI, a web interface for Nginx, had a bug on the /api/users/:id user‑management endpoint. The endpoint allowed any authenticated user to change anyone else's password without requiring the RequireSecureSession step‑up that the self‑service password‑change flow mandates. This omission gives an attacker who has logged into the application the ability to reset the administrator’s password, invalidate the administrator’s existing session tokens, and then authenticate as the administrator. The flaw is a classic authentication bypass and privileged‑escalation weakness (CWE‑285) that also violates the principle of least authorization (CWE‑862).

Vendor 0xJacky, product Nginx UI, all releases prior to 2.4.1 are vulnerable. Versions 2.4.1 and newer include the security fix that enforces RequireSecureSession on the user‑management API.

The vulnerability has a CVSS score of 8.7, classifying it as high severity. It is not listed in the CISA KEV catalog and the EPSS score is unavailable, but the low access requirement—an authenticated account—means the exploitability is high. An attacker only needs to log into the UI to change the administrator password; the path is remote and does not require special network segments or elevated permissions. Consequently the risk to systems running affected Nginx UI versions is significant, especially when default or weak credentials are used.