Home / Vulnerability Intelligence / CVE-2026-42223

CVE-2026-42223 - Vulnerability Analysis

MediumCVSS: 6.5

Last Updated: May 6, 2026

Nginx UI - Information Disclosure

Published: May 4, 2026Updated: May 6, 2026PoC AvailableRemote Exploitable

Overview

Nginx UI < 2.3.8 contains an information disclosure caused by improper enforcement of protected field tags during settings reads in GetSettings API, letting authenticated users access sensitive configuration data, exploit requires user authentication.

Severity & Score

Severity: Medium

CVSS Score: 6.5

Impact

Authenticated users can access sensitive configuration data, enabling token forgery, impersonation, and account takeover.

Mitigation

Upgrade to version 2.3.8 or later.

References

https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-q4w7-56hr-83rm

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-42223
Severity: Medium
CVSS Score: 6.5
Type: broken_access_control
Status: confirmed

CWE

CWE-200

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N