CVE-2026-33030
Nginx UI: Unencrypted Storage of DNS API Tokens and ACME Private Keys
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
5th
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.
| CWE | CWE-78 CWE-639 |
| Vendor | 0xjacky |
| Product | nginx-ui |
| Published | Mar 30, 2026 |
| Last Updated | Mar 31, 2026 |
Stay Ahead of the Next One
Get instant alerts for 0xjacky nginx-ui
Be the first to know when new high vulnerabilities affecting 0xjacky nginx-ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
0xJacky / nginx-ui
<= 2.3.3