CVE-2026-79316
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Improper access control vulnerability in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template and trigger a panel restart, causing the xray management gRPC service, bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.
Risk Assessment
Increased attack surface on the management interface, potentially enabling remote access to sensitive functions.
Recommendation
Update x-ui to a patched version. Restrict user privileges and enforce loopback binding for services.
Other vulnerabilities in x-ui
See all- CVE-2026-79315Medium
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.
- CVE-2026-79314Unknown
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.
- CVE-2026-79317Medium
Session invalidation flaw in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication does not re-validate against the database. Changing username or password does not revoke previously issued cookies, so an attacker with a valid cookie can continue accessing the admin panel.
Original NVD description (English source)
An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.