Summary
An improper access control vulnerability in x-ui allows any authenticated panel user to modify the Xray configuration template and restart the panel. This can cause the Xray management gRPC service to listen beyond loopback, expanding access to an interface intended to remain local.
Affected context
The issue occurs in x-ui deployments where authenticated panel users can change the Xray configuration template through the settings interface and trigger a panel restart. It becomes risky when the regenerated Xray management gRPC service is configured to bind to non-loopback addresses, making the service reachable from networks that were not intended to access it.
Exploit preconditions
- Attack surface: The authenticated x-ui settings and restart functionality - Required access: Any valid authenticated panel account with access to the
relevant settings interface
- Trigger point: Saving a modified Xray configuration template and causing
the panel to restart
- Why exploitation is possible: Authorization does not sufficiently restrict
configuration changes that influence the management service's network
binding
Why this happens
The underlying flaw is insufficient authorization around a security-sensitive configuration path. A general authenticated panel user can alter a template that controls the exposure of the Xray management service, and the resulting configuration is applied during restart without adequately enforcing the intended loopback-only boundary. This behavior maps to CWE-284, Improper Access Control, because access permissions do not properly protect a privileged management-surface configuration.
Potential impact
- The management gRPC service may become reachable from unintended network segments.
- An attacker could gain additional opportunities to interact with exposed management functionality.
- The expanded service exposure could enable unauthorized administrative actions, depending on service controls.
- The affected host or connected services could face increased risk from follow-on attacks.
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the setting and action level, rather than relying only on panel authentication. Management services should use secure-by-default loopback binding or an explicitly allowlisted private interface, and configuration schemas should reject externally reachable bindings unless they are intentionally authorized. Separate ordinary user permissions from security-sensitive configuration and restart privileges, reduce trust in user-controlled templates, and apply least-privilege service accounts and network policies. Configuration changes should be validated before activation and protected with auditable approval controls where appropriate.
How teams detect issues like this
Review authorization checks for settings that control network bindings, service exposure, and restart behavior. Static analysis and code review can look for authenticated-but-unrestricted configuration handlers, template values copied into listener addresses, and restart paths that apply settings without policy validation. Runtime monitoring can alert on changes to Xray listener bindings, panel restarts, and management services listening on non-loopback addresses. Network policy enforcement and configuration compliance checks can detect deviations from the intended local-only exposure.
