EUVD-2026-84491
GHSA-xr6g-3g96-fmgq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to x-ui panel as low-priv user
-
DeliveryEnumerate target inbound resource IDs
-
ExploitSubmit update request referencing victim ID
-
ExecutionServer skips ownership check
-
ImpactOverwrite victim proxy config
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the x-ui panel (PR:L) - the panel must be running in a multi-user configuration where more than one account holds inbound proxy resources, since the flaw is cross-user modification. The attacker must be able to reference the target user's inbound resource identifier (enumerable/guessable integer or handle) and reach the inbound-update endpoint over the network (AV:N). Limiting factors: exploitation is confined to environments where the panel is shared among multiple tenants and where the attacker already has account access; a single-admin deployment has no other user's resources to tamper with, and no user interaction is required from the victim. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) reflects a network-reachable, low-complexity flaw exploitable by any authenticated user with no user interaction, which is credible for a web-panel IDOR. However, the C:H/I:H/A:H impact triad appears overstated for the described behavior: this is a horizontal (same-privilege) authorization flaw where the update path fails an ownership check, letting an authenticated user modify OTHER users' inbound proxy configurations (remark, port, protocol, settings, enabled state, expiry, traffic quota). The dominant impact is integrity (unauthorized cross-user modification); availability is partial (disabling or expiring another tenant's inbound), and confidentiality is at most partial (the request references the target resource but the description emphasizes modification, not disclosure) - so a real-world score nearer 6.5-7.1 is more defensible. Exploitation signals are low: EPSS is 0.20% (10th percentile), there is no CISA KEV listing, and no confirmed public exploit code (a third-party writeup exists in the TraceLoom repo but is an advisory/analysis, not verified weaponized code). Net: a genuine authorization bug worth patching, but PR:L gating (requires a valid panel account) plus low EPSS and no KEV make this a moderate, not urgent, priority - the 8.8 rating overstates real-world severity. |
| Exploit ScenarioDerived | An attacker who holds any legitimate low-privilege account on a shared x-ui panel enumerates or guesses inbound resource identifiers belonging to other users and submits a crafted update request against a target ID. Because the server never verifies the resource belongs to the requesting session, the attacker silently alters another tenant's proxy settings - changing its port/protocol, disabling it, or resetting expiry/quota. No public exploit code is confirmed, though a third-party technical writeup describing the flaw is available. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Horizontal privilege escalation in the x-ui web panel 0.3.2 allows any authenticated panel user to rewrite another user's inbound proxy configuration - remark, port, protocol, settings, enabled state, expiry time and traffic quota - by submitting an inbound-update request that carries the victim's resource identifier, because the update path never verifies that the referenced inbound belongs to the requesting session user (CWE-284). The flaw is network-reachable and requires no victim interaction, with a CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8); an independent assessment retains High severity and confirms the integrity impact (cross-tenant configuration tampering) while narrowing confidentiality and availability to Low, since the tampering is confined to proxy resource data rather than granting panel or host compromise. Exploitation is limited to multi-tenant deployments where more than one account holds inbound resources; no public exploit code has been identified at time of analysis and EPSS is low (0.20%, ~10th percentile), so mass scanning is unlikely, though the flaw is trivially reachable by any legitimate panel account.
RemediationAI
No vendor-released patch was identified in the available intelligence at time of analysis: the references resolve to the upstream project repository (https://github.com/vaxilu/x-ui) and a third-party CVE write-up (https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79314.md) rather than a tagged fixed release, so remediation must currently rely on compensating controls. The most effective control follows directly from the assessed prerequisites: run the panel in a single-admin configuration, or give each tenant its own isolated panel instance (separate container/host with its own port and data directory), which removes the cross-user resource identifiers the attack depends on - the trade-off is loss of centralized multi-tenant management and higher operational overhead. Second, restrict network reachability of the panel and its inbound-update endpoint: bind the panel to localhost or a management interface, front it with a reverse proxy enforcing IP allow-listing and client authentication, or require VPN access, and block the panel port from untrusted networks - the trade-off is that remote administrators lose direct access and must use the VPN/proxy path. Third, minimize the blast radius of any compromised or rogue panel account by enforcing least-privilege roles, strong unique credentials, and MFA at the proxy layer where supported. Fourth, monitor and audit: baseline inbound objects (remark, port, protocol, enabled state, expiry, traffic quota, https://nvd.nist.gov/vuln/detail/CVE-2026-79314) and alert on modifications that do not match the owning account's session, since this attack manifests as unauthorized configuration drift rather than a crash or exploit artifact. Because EPSS is only 0.20% and no public exploit code has been identified, urgent emergency change procedures are not warranted, but the fix should still be scheduled promptly for any multi-user deployment pending an upstream patched version.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
x-ui is a web-based management panel for Xray/V2Ray proxy servers, in which each account owns one or more 'inbound' objects describing listeners (port, protocol, transport settings, remark, enabled flag, expiry and traffic quota). The vulnerability is a textbook Insecure Direct Object Reference nested in what is classified as CWE-284 (Improper Access Control): the inbound-update handler authenticates the session but authorizes only on the client-supplied resource identifier, performing no ownership comparison against the session user, so the same identifier space is shared across tenants. The affected CPE string supplied by the feeds is the uninformative placeholder cpe:2.3:a:n/a:n/a, meaning no authoritative vendor/product CPE mapping exists; product identification rests on the free-text description and the ENISA EUVD record EUVD-2026-84491, which likewise carries 'n/a n/a' as its affected-version entry. The underlying technology class is a proxied in-memory/JSON datastore of inbound objects updated through an HTTP endpoint, which is why the impact is configuration integrity across account boundaries rather than memory corruption; per the independent assessment, the attacker must possess a valid session (PR:L), be able to reference the target's identifier (enumerable integer or handle), and reach the inbound-update endpoint over the network (AV:N), with no UI:N requirement and no victim interaction.
Know when Go gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated network IDOR (PR:L, AV:N, AC:L); impact is chiefly integrity (I:H) with partial availability from disabling/expiring inbounds (A:L) and limited confidentiality (C:L).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.
Executive ViewAI
The x-ui web panel version 0.3.2 contains an access-control flaw that allows any signed-in panel user to alter the proxy configurations of other customers on the same installation, exposing hosting, VPN and proxy-service providers that operate multiple tenants on a single panel to unauthorized changes to customer services and potential traffic redirection. Because the issue affects tenant-facing service integrity rather than internal systems alone, it is a customer-trust and contractual risk for any team running the product in a shared or reseller model. No vendor-released patch is currently available, so isolation of tenants and early detection are the primary levers until a fix ships.
No vendor-released patch identified at time of analysis, so interim mitigations are required: run the panel in single-tenant mode or one instance per tenant so no account can reference another account's inbounds; restrict panel access to trusted networks, VPN or an authenticated reverse proxy; enforce least-privilege, unique accounts and MFA where supported; monitor and alert on inbound-update requests referencing resource identifiers outside the requesting session's ownership; maintain frequent backups of inbound configurations with a tested rollback path; and migrate to a maintained alternative panel if the upstream project does not ship a fix.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
Host header injection in Nezha 2.2.3's OAuth2 redirect endpoint (/api/v1/oauth2/{provider}) allows an unauthenticated re
Session cross-wiring in SUSE NeuVector before 5.6.1 allows an unauthenticated remote attacker to obtain another user's a
Unauthenticated path traversal in Uber Kraken through 0.1.29 allows remote attackers to read files outside the configure
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash
Account takeover in Klever-Go's KleverUpdateAccountPermission built-in (all versions prior to 1.7.20) allows an attacker
Maliciously crafted on-chain account names processed by Klever-Go prior to 1.7.20 are spliced into Elasticsearch _bulk r
Exploit-DB