CVE-2026-79316 in x-ui
Summary
by MITRE • 09/21/2026
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in x-ui version 0.3.2 represents a critical failure in access control mechanisms that allows authenticated users to escalate their privileges effectively by altering core system configurations. Specifically, the flaw resides within the settings interface of the web panel, which permits any user with valid credentials to modify the underlying Xray configuration template. This capability is intended for administrative purposes only but lacks sufficient validation or role-based restrictions, thereby enabling lower-privileged accounts to execute changes that impact the entire service infrastructure. The consequence of this modification triggers an automatic restart of the x-ui panel and its associated components, a process that inadvertently regenerates the network bindings for critical services without enforcing security boundaries.
The technical core of this vulnerability lies in the regeneration of the Xray management gRPC service during the restart cycle. By default, this management interface is configured to bind exclusively to loopback addresses such as 127.0.0.1 or ::1, ensuring that it remains inaccessible from external networks and limiting exposure to local processes only. However, when an authenticated user modifies the configuration template through the vulnerable settings endpoint, they can alter these binding parameters. Upon restart, the service binds to non-loopback addresses, such as 0.0.0.0 or specific public IP interfaces, effectively exposing the management gRPC port to the broader network. This action bypasses the intended local-only boundary, transforming a locally confined administrative interface into a remotely accessible attack surface.
The operational impact of this vulnerability is severe due to the nature of the exposed service. The Xray management gRPC interface typically provides high-level control over proxy operations, including user management, traffic statistics, and configuration updates. When bound to non-loopback addresses without additional authentication or network segmentation safeguards, it becomes reachable by any entity on the local network segment or potentially the internet if firewall rules are permissive. An attacker who has obtained valid credentials for a low-privileged x-ui account can exploit this misconfiguration to gain unauthorized administrative control over the proxy infrastructure. This could lead to complete compromise of the privacy and anonymity guarantees provided by the service, manipulation of traffic routing, or use of the server as part of a botnet.
From a classification perspective, this issue aligns with CWE-269, Improper Privilege Assignment, as it allows users to perform actions reserved for administrators. It also relates closely to CWE-732, Incorrect Permission Assignment for Critical Resource, because the configuration file governing network bindings is modified by an unauthorized actor. In terms of attack vectors, this vulnerability facilitates lateral movement and privilege escalation within a compromised environment, mapping to MITRE ATT&CK techniques such as T1098.004 (SSH Authorized Key Modification) in spirit if one considers the gRPC interface analogous to shell access, or more accurately T1531 (Account Access Removal) combined with T1078 (Valid Accounts), where valid but low-privileged accounts are leveraged to achieve higher-level control through configuration manipulation.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most urgent step is to upgrade x-ui to a version that patches this specific access control flaw, ensuring that the settings interface restricts modification of Xray configuration templates to users with explicit administrative roles only. Administrators should also audit existing configurations to ensure no active instances are bound to non-loopback addresses for management interfaces unless absolutely necessary and protected by additional authentication layers or network firewalls. Implementing strict role-based access control (RBAC) within the application logic is essential to prevent unauthorized configuration changes. Furthermore, deploying a reverse proxy with strong authentication in front of any externally facing services can provide an additional layer of defense, ensuring that even if internal bindings are misconfigured, external access remains restricted to authorized personnel only. Regular security audits and penetration testing should be conducted to verify that privilege boundaries remain intact after updates or configuration changes.