CVE-2026-33031— Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
Quick assessment
Affected
0xJacky nginx-ui
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Nginx UI是Jacky个人开发者的一个 Nginx 的 WebUI。 Nginx UI 2.3.4之前版本存在安全漏洞，该漏洞源于禁用用户仍可使用先前颁发的API令牌，可能导致攻击者在账户被禁用后继续访问受保护资源。
Possible ATT&CK Techniques 3 AI
T1136.001 · Local Account T1136.002 · Domain Account T1078.003 · Local Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-33031
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nginx-UI: Disabled users retain full API access through previously issued bearer tokens
Source: CVE Program / CVE List V5
Vulnerability Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Nginx UI 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Nginx UI是Jacky个人开发者的一个 Nginx 的 WebUI。 Nginx UI 2.3.4之前版本存在安全漏洞，该漏洞源于禁用用户仍可使用先前颁发的API令牌，可能导致攻击者在账户被禁用后继续访问受保护资源。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-33031
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-33031
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-33031 (1)
IV. Related Vulnerabilities
Same product: nginx-ui
-
CVE-2026-44015
Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Pro -
CVE-2026-42238
Unauthenticated Remote Code Execution via Backup Restore in -
CVE-2026-42223
nginx-ui: Settings API Exposes Protected Secrets -
CVE-2026-42222
nginx-ui: Unauthenticated first-boot instance claim via POST -
CVE-2026-42221
nginx-ui: Unauthenticated First-Run Installer Allows Remote
Same vendor: 0xJacky
-
CVE-2026-44015
Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Pro -
CVE-2026-42238
Unauthenticated Remote Code Execution via Backup Restore in -
CVE-2026-42223
nginx-ui: Settings API Exposes Protected Secrets -
CVE-2026-42222
nginx-ui: Unauthenticated first-boot instance claim via POST -
CVE-2026-42221
nginx-ui: Unauthenticated First-Run Installer Allows Remote
Same weakness: CWE-284
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-63045
Apache HTTP Server: mod_proxy_ftp PASV address handling -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access
V. Comments for CVE-2026-33031
No comments yet