Nginx UI CVE-2026-107809

Exploitation requires a victim who is a currently logged-in Nginx UI administrator whose JWT is held in a browser-managed cookie, and who is induced to visit or interact with an attacker-controlled page (UI:R). The targeted management endpoint (e.g. POST /api/configs) must lack CSRF-token enforcement and Origin/Referer validation - which per the advisory is the default in versions 2.0.0 through 2.4.x. A critical limiting factor: the administrator account must NOT have OTP/Passkey protection on the operation, or the endpoint must not require secure-session proof; accounts with step-up authentication on sensitive endpoints are not exploitable. The attacker cannot read the cross-origin response, limiting the flaw to blind state-changing actions (config modification, reloads, management operations) rather than data exfiltration. Fixed in 2.5.0.

This is a credible, high-priority vulnerability for exposed Nginx UI instances, though not a drop-everything emergency absent evidence of active exploitation. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, 8.8) correctly reflects a network-reachable, low-complexity CSRF that the attacker launches with no privileges of their own - they ride a logged-in administrator's authenticated session. The key moderating signal is UI:R: exploitation is not automatable and requires a human administrator to be lured into visiting an attacker-controlled page while logged in, which argues for targeted rather than spray-and-pray exploitation. No EPSS score, no CISA KEV listing, and no public exploit were supplied in the intelligence, so there is no evidence of active exploitation; the risk is driven by severity and ease of the technique, not by observed in-the-wild use. One cross-signal tension to flag: the input assigns C:H, but the description explicitly states the attacker cannot read the cross-origin response - this makes a High confidentiality rating questionable, and the impact is more accurately integrity/availability (config modification, reloads) than direct data disclosure. SSVC-style framing: exploitation=none observed, automatable=no (requires victim interaction), technical impact=total over the Nginx configuration.

A remote attacker crafts a malicious web page containing a hidden auto-submitting form or fetch that issues POST /api/configs to a victim's Nginx UI instance. When a logged-in administrator (whose JWT is stored in a browser-managed cookie, and who lacks OTP/Passkey on the targeted operation) visits the page, their browser automatically attaches the session cookie and the state-changing request succeeds. No public exploit was identified at time of analysis, but the CSRF technique is trivial to reproduce given AV:N/AC:L.