High severity · published Sep 28, 2026
CVE-2026-102335
Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control routing for their assigned hosts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NG
nginx-proxy-manager · NginxProxyManager
through 2.16.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102335
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102335
issue-tracking
https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5749
patch
https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5908
technical-description
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/internal/user.js#L52-L62
technical-description
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/backend/templates/proxy_host.conf#L28
technical-description
https://github.com/NginxProxyManager/nginx-proxy-manager/blob/v2.16.0/README.md#L36
product
https://github.com/NginxProxyManager/nginx-proxy-manager
More from nginx-proxy-manager
7.5
CVE-2026-40519
Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()
7.4
CVE-2026-102334
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
5.3
CVE-2026-93964
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
4.8
CVE-2022-28379
jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion