Skip to content

Improper Access Control on Advanced Nginx Configuration Feature #5749

Description

@bipol4r

Checklist

  • Have you pulled and found the error with jc21/nginx-proxy-manager:latest docker image?
    • Yes
  • Are you sure you're not using someone else's docker image?
    • Yes
  • Have you searched for similar issues (both open and closed)?
    • Yes

Describe the bug
The project documentation indicates that "Advanced Nginx configuration" is intended for super-user access only, and the system includes user management, permissions, and audit logging capabilities.In reality, any authenticated standard (non-admin) user authorized to manage Proxy Hosts / Redirection Hosts / 404 Hosts can abuse the "Custom Nginx Configuration" feature to inject raw Nginx directives.

Nginx Proxy Manager Version
v2.15.1

To Reproduce
Steps to reproduce the behavior:

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior
advanced_config should be restricted per the documentation ("super users"): enforce an admin-only check at the API layer for create/update payloads containing advanced_config on all host types, or introduce a dedicated permission flag for raw nginx configuration.
New users should not receive manage on every section by default (least privilege).

Screenshots

Operating System

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions