Summary
An authorization flaw in x-ui allows an authenticated user to modify inbound proxy configurations belonging to other users. The issue becomes risky when an update request accepts a resource identifier without verifying that the referenced resource is owned by the requesting session user.
Affected context
The vulnerability occurs in x-ui's inbound proxy configuration update path when a user-supplied resource identifier is used to select the target configuration. Deployments are exposed when the update operation does not enforce ownership or tenant boundaries before changing fields such as remarks, ports, protocols, settings, enabled state, expiry time, or traffic quotas.
Exploit preconditions
- Attack surface: Authenticated inbound-configuration update endpoint
- Required access: A valid user session with permission to submit inbound update requests
- Trigger point: An update request referencing an inbound resource identifier
- Why exploitation is possible: The server processes the target identifier without confirming that the resource belongs to the requesting user
Why this happens
The underlying defect is an object-level authorization failure. The update handler trusts a client-provided resource identifier and applies changes without constraining the database lookup or authorization decision to the current session user. This maps to CWE-284: Improper Access Control, specifically a missing ownership check that permits horizontal privilege escalation across peer accounts.
Potential impact
- An authenticated user may alter another user's inbound proxy configuration
- Unauthorized changes could disrupt traffic routing or service availability
- An attacker could modify expiry times or traffic quotas
- Configuration integrity and tenant isolation could be weakened
- Changes to protocol or settings may create secondary security or operational risks
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the resource-operation boundary rather than relying on client-supplied identifiers.
Common defensive patterns include:
- Binding resource queries and update operations to the authenticated user's identity or tenant
- Performing server-side ownership and policy checks immediately before modification
- Avoiding authorization decisions based solely on request parameters
- Applying field-level authorization where sensitive configuration attributes require additional privileges
- Using least-privilege roles and strict tenant isolation by default
- Returning consistent responses that do not disclose whether another user's resource exists
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that flag object updates based on unscoped request identifiers
- Code review checks for missing user, tenant, or ownership predicates in update queries
- Integration tests that attempt cross-user access to read and modify the same resource
- API policy enforcement requiring subject identity and resource ownership to be evaluated together
- Audit logging that records the authenticated actor, target resource, and authorization decision
Automated security testing and code review tools may help identify missing object-level authorization checks.
