Vulnerability · Published Sep 28, 2026 · Assigned by VulnCheck
CVE-2026-102335Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config
High 7.1
In plain English
A high-severity incorrect authorization in nginx-proxy-manager from NginxProxyManager. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 86.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NginxProxyManager | nginx-proxy-manager | 0 – through 2.16.0 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
- https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5749 issue-tracking
- https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908 patch, issue-tracking
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/user.js#L52-L62 technical-description
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/templates/proxy_host.conf#L28 technical-description
- https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/README.md#L36 technical-description
- https://github.com/NginxProxyManager/nginx-proxy-manager product
- VulnCheck Advisory: Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config third-party-advisory