VulnSocial

CVE-2026-33031Disclosure(nginxui / nginx_ui)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens for up to the token lifetime. In practice, disabling a compromised account does not actually terminate that user’s access, so an attacker who already stole a JWT can continue reading and modifying protected resources after the account is marked disabled. Since tokens can be used to create new accounts, it is possible the disabled user to maintain the privilege. Version 2.3.4 patches the issue.

nginxui CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-284CWE-863

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • nginx_ui

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-04-21); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
nginxui
Products
nginx_ui

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-21: 1Mentions · 2026-04-28: 1Technical Details · 2026-04-21: 1Technical Details · 2026-04-28: 104-2104-28
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • cvereports@_cvereports
    Disclosure

    CVE-2026-33031: CVE-2026-33031: Improper Access Control via Stateless JWT Validation in Nginx UI Nginx UI versions prior to 2.3.4 contain an improper access control vulnerability resulting from incomplete JSON Web Token (JWT) validation. The applicati... https://cvereports.com/reports/CVE-2026-33031

    Post summary

    The report provides technical details on an improper access control vulnerability in Nginx UI caused by incomplete JWT validation, but it does not include any PoC, exploit code, active exploitation evidence, or patch information.

    0000028
    36 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-33031 Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previously issued API tokens fo… https://www.cve.org/CVERecord?id=CVE-2026-33031

    Post summary

    The CVE describes an access‑control issue in Nginx UI before version 2.3.4, where disabled users can use old API tokens, but no PoC, exploit, or active exploitation is reported, and no patch is explicitly mentioned.

    0000079
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appnginxuinginx_ui---

Explore more

Back to dashboardnginxui CVEsnginx_ui vulnerabilities