CVE-2026-79314 in x-ui
Summary
by MITRE • 09/22/2026
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in x-ui version 0.3.2 represents a critical horizontal privilege escalation flaw rooted in broken access control mechanisms within the application's backend logic. This specific weakness allows an authenticated attacker who possesses valid credentials for one user account to manipulate configuration settings belonging to other distinct users on the same system. The core technical failure lies in the server-side processing of inbound proxy modification requests, where the endpoint responsible for updating these configurations does not perform adequate authorization checks against the identity of the requesting session. Instead of validating that the resource identifier provided in the request corresponds exclusively to an entity owned by or associated with the authenticated user making the call, the application blindly trusts the input data and applies changes directly to the specified target. This lack of object-level permission verification creates a direct pathway for unauthorized cross-user modification of sensitive operational parameters.
From a technical perspective, this flaw is classified under CWE-639, which describes authorization bypass through a vulnerability in indirect reference management. The application fails to enforce proper ownership checks when handling updates to inbound proxy configurations. When an authenticated user submits a request containing the identifier for another user's configuration object, the backend processes the update without verifying that the current session holder has administrative rights over or ownership of that specific resource. This oversight permits the attacker to alter critical attributes such as remarks, port numbers, protocol types, detailed settings, enabled states, expiry times, and traffic quotas associated with victim accounts. The absence of these checks effectively neutralizes the isolation boundaries between different user sessions within the multi-tenant environment managed by x-ui.
The operational impact of this vulnerability is severe due to the nature of the data being manipulated. Inbound proxy configurations are fundamental to the functionality of network infrastructure management tools, often serving as gateways for traffic routing and access control. By modifying these settings, an attacker can disrupt service availability for other users by disabling their proxies or altering port assignments that render them inaccessible. Furthermore, changing expiry times allows the attacker to prematurely terminate services belonging to others, causing denial-of-service conditions without needing elevated privileges. The ability to modify traffic quotas enables resource exhaustion attacks against specific targets while potentially consuming shared infrastructure limits. Additionally, tampering with protocol settings and detailed configurations can introduce security weaknesses into other users' environments or redirect their traffic through malicious endpoints if the attacker controls the underlying proxy logic, leading to potential data interception or man-in-the-middle scenarios for affected parties.
This vulnerability aligns closely with MITRE ATT&CK technique T1078, specifically Valid Accounts and Horizontal Privilege Escalation variants where an actor uses legitimate credentials but exploits a flaw in access control to perform actions outside their intended scope. It also relates to CWE-269 regarding improper privilege management, as the application grants capabilities that exceed the user's actual role or ownership rights. The exploitation requires no special privileges beyond basic authentication, making it highly accessible to any registered user of the platform who can enumerate valid resource identifiers through API exploration or predictable ID patterns.
To mitigate this vulnerability, immediate patching to a version later than 0.3.2 is required if such an update exists and addresses these access control flaws. In the interim, administrators should implement strict server-side validation that ensures every modification request includes verification of ownership against the authenticated user's session context. This involves querying the database or application state to confirm that the target resource identifier belongs exclusively to the requesting user before processing any updates. Additionally, implementing robust input validation and using non-sequential, unpredictable identifiers for resources can reduce the ease with which attackers discover valid targets. Enforcing principle of least privilege by restricting access to configuration endpoints based on explicit role-based permissions rather than just authentication status is also recommended. Regular security audits focusing on object-level authorization checks across all API endpoints are essential to prevent similar horizontal escalation vectors in future development cycles.