CVE-2026-33031: Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
Vulnerability summary
CVE-2026-33031 is a high (CVSS 8.6) Improper Access Control vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 19.9% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 20-04-2026PublishedVulnerability first disclosed.
- 21-04-2026Last modifiedVulnerability information updated.
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.
CVSS metrics
5 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.6HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
Decrease -0.12 pp
From 0.39% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundNginx Ui
Maturity: poc
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
0xjacky1 product
- nginx-ui< 2.3.4
Github.com/0xJacky1 product
- Nginx-UI< 1.9.10-0.20260314152518-7b66578adb47
Nginxui1 product
- nginx_ui< 2.3.4
3 vendors · 3 products
References
5 links- github.com/0xJacky/nginx-ui/security/advisories/GHSA-x234-x5vq-cc2vX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/0xJacky/nginx-uiPACKAGE