UpHeron
All vulnerabilities

Servers and applications

GHSA-mfj4-8rf3-rpq6

Unauthenticated dependency inventory + version disclosure via `/api/licenses*`

Severity
Medium 5.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Fixed in
2.9.1
Weakness
Information exposure (CWE-200)Exposure of system information (CWE-497)
Attack
Over the network · No login needed · No user action needed
Attacker can
Read some data
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Sources
Project advisories (GitHub)

Description

Privilege required: none - unauthenticated.

GET /api/licenses, /api/licenses/backend, /api/licenses/frontend, and /api/licenses/stats return the full Go-module dependency list and component/version inventory of the running nginx-ui with no authentication. The /licenses group is attached to the bare /api root group, which carries only IPWhiteList() - and that is fail-open when the allowlist is empty (the default).

  • license.InitRouter(root) (router/routers.go:76) registers the /licenses routes on the bare root := r.Group("/api", middleware.IPWhiteList()) (router/routers.go:71) - not inside any AuthRequired group (those are created later, at :91 onward).
  • IPWhiteList() (internal/middleware/ip_whitelist.go) returns c.Next() when settings.AuthSettings.IPWhiteList is empty (default), so it is not an authentication barrier.
  • GetBackendLicenses()/GetLicenses() (api/license/license.go) return the complete module dependency graph with versions and component metadata.
From 0xJacky/nginx-ui's security advisory. Shortened; the full text is there.

Workarounds

Configure the IP allowlist, or block /api/licenses at the reverse proxy until you can upgrade.

Workarounds as given by 0xJacky/nginx-ui's security advisory.

Affected software

SoftwareAffected versions
Nginx UIServers and applications · github:0xjacky/nginx-ui
  • Every version before 2.9.1

References