Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerabili…

Nginx UI versions 2.3.3 and prior contain an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users to access, modify, and delete resources belonging to other users. The vulnerability stems from the application's base Model struct lacking a user_id field, with all resource endpoints performing queries by ID without verifying user ownership. This enables complete authorization bypass in multi-user environments. No publicly available patches exist at the time of publication.