Access Control Flaw in Nginx UI Affects User Authentication Integrity

CVE-2026-33031

What is CVE-2026-33031?

Nginx UI, a web-based interface for managing Nginx servers, suffers from an access control vulnerability that allows users who have been disabled by administrators to continue using previously issued API tokens. This security gap enables an attacker, with access to a compromised token, to retain entry to protected resources even after their account is marked as disabled. Consequently, attackers could exploit this flaw to modify data or create new accounts with the same privileges. The issue is addressed in version 2.3.4, which requires immediate upgrading to ensure the security of user accounts and API interactions.

References