Servers and applications
GHSA-hf3h-p3fr-3f2r
Full backup exports expose reusable interactive login sessions to management credentials
- Severity
- Medium 6.6
- Published
- 12 Nov 2026
- Last changed
- 12 Nov 2026
- Added to UpHeron
- 12 Nov 2026
- Fixed in
- 2.9.1
- Attack
- Over the network · Only under certain conditions · Needs an administrator account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H- Sources
- Project advisories (GitHub)
Description
An api:write service token can export a full backup. Before 2.9.1, the application database inside that backup included still-active interactive login sessions. Replaying an exported, still-active session gives the holder an interactive administrator session, which reaches routes that service tokens are denied (user and token management, 2FA, protected settings). Accounts with an enrolled factor still require a fresh secure-session step-up.
This does not allow forging JWTs: every session must match a stored record. It does not bypass MFA and does not revive sessions that were revoked or expired. Exporting backups with api:write remains an intended capability.
The impact claims below were narrowed by the maintainer assessment at the end: JWT forgery and full takeover were not demonstrated.
A write-scoped service token (api:write) can download a full backup via GET /api/backup, including the AES decryption key in the X-Backup-Security response header.
Workarounds
Enable 2FA on administrator accounts. Treat backups made before 2.9.1 as containing live sessions, and sign out existing sessions after upgrading.
Affected software
| Software | Affected versions |
|---|---|
Nginx UIServers and applications · github:0xjacky/nginx-ui |
|
References
- GitHub Advisory Database https://github.com/advisories/GHSA-hf3h-p3fr-3f2r
- github.com https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-hf3h-p3fr-3f2r