CVE-2026-33030 Details

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in Nginx UI versions through 2.3.3. This vulnerability enables authenticated users to access, modify, and delete resources belonging to other users. The issue arises because the application's base Model structure does not include a user_id field, and resource endpoints query by ID without verifying user ownership. This flaw creates a complete authorization bypass in multi-user environments. Additionally, sensitive data such as DNS API tokens and ACME private keys is stored in plaintext, exacerbating the vulnerability by allowing immediate credential theft without decryption.

To address this vulnerability, it is recommended to add user ownership fields to the application's data models, implement authorization checks to ensure users can only access their own resources, and encrypt sensitive data before storage.