ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33030

Nginx UI is a web user interface for the Nginx web server.

Published Mar 30, 2026 · updated Jun 17, 2026 · nginxui nginx ui

Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 30, 2026 · NIST NVD

    Detected

    Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user owner

  2. Jun 17, 2026 · NIST NVD

    Updated

    Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user owner

Affected

  • cpe nginxui/nginx uiversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33030

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33030

    Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application'

    nvd.nist.gov

References