Is CVE-2026-79314 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79314 being exploited in the wild.

How severe is CVE-2026-79314?

High severity, with a CVSS score of 8.8, published 22 September 2026.

Which products and versions are affected?

Vaxilu X-Ui 0.3.2 and later development branch.

Is there a fix for CVE-2026-79314?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-79314 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-79314?

Check whether you run Vaxilu X-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79314: x-ui horizontal privilege escalation in inbound configuration management

CVE-2026-79314 · Severity: high · CVSS 8.8 · Published 2026-09-22

x-ui is a web-based proxy management panel used by administrators to configure and control proxy services across multiple user accounts. An authenticated user can delete or modify proxy configurations belonging to other users by directly referencing their configuration identifiers, effectively taking down another account's service or destroying their configuration. This horizontal privilege escalation requires only basic user credentials and knowledge of target configuration IDs, making it a significant risk in shared deployments.

Technologies: Vaxilu X-Ui. Vendors: Vaxilu.

Quick answers

Is CVE-2026-79314 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79314 being exploited in the wild.
How severe is CVE-2026-79314?: High severity, with a CVSS score of 8.8, published 22 September 2026.
Which products and versions are affected?: Vaxilu X-Ui 0.3.2 and later development branch.
Is there a fix for CVE-2026-79314?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-79314 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-79314?: Check whether you run Vaxilu X-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-639) in the inbound configuration deletion operation: the endpoint accepts a record identifier from the request and deletes it without verifying that the record belongs to the authenticated user's account. The deletion path lacks the ownership check present in other inbound-related operations (listing, creation, modification), allowing cross-account data destruction. The issue requires authentication but no special privileges, administrator access, or user interaction; exploitation only requires knowledge of a target configuration ID.

Affected products

vaxilu x-ui 0.3.2 and later development branch

Timeline

2026-09-22: disclosed: Public disclosure via NVD
2026-08-04: other: Vulnerability reported and confirmed by reproduction

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.