Auth bypass in 0xjacky Nginx-Ui
CVE-2026-33031
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.
EPSS: 0.003 (19.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
Affected products
- 0xjacky Nginx-ui — versions < 2.3.4
- Nginxui Nginx_ui
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-33031?
- CVE-2026-33031 is a high-severity vulnerability in 0xjacky Nginx-Ui, classified under Improper Access Control. CVSS score: 8.1/10. Published 2026-04-20.
- How severe is CVE-2026-33031?
- High severity. CVSS v3 base score is 8.1 out of 10.