Description

An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-09-21T21:17:12.100Z",
  "pubdate": "2026-09-21T21:17:12.100Z",
  "executiveSummary": "An improper access control vulnerability has been identified in x-ui version 0.3.2, categorized as a configuration integrity and management interface exposure flaw.\nThe vulnerability allows an authenticated panel user to manipulate the xray configuration template via the settings interface, subsequently forcing a service restart.\nThe primary security implication is the unintended modification of the xray management gRPC service binding, transitioning it from a secure loopback-only configuration to an externally reachable non-loopback address.\nThis expansion of the attack surface grants unauthorized remote access to the management gRPC interface, bypassing intended network segmentation.\nExploitation requires authenticated access to the panel, but the resulting impact compromises the confidentiality and integrity of the underlying xray infrastructure.\nThe flaw represents a significant risk to the security posture of the host system, as the management interface was designed exclusively for local service interaction.\nNo external network exposure is required for the initial configuration modification, making this an internal privilege escalation and service misconfiguration attack.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient authorization logic within the x-ui 0.3.2 settings interface, which permits authenticated users to overwrite core xray configuration templates.\nWhen a user modifies the xray configuration template, the application triggers an automated restart of the xray management service to apply the new settings.\nUnder default operating conditions, the xray management gRPC service is restricted to the 127.0.0.1 (loopback) interface, ensuring that control operations are only possible from the local host.\nHowever, due to the lack of validation on the template input, an attacker can supply a configuration that instructs the gRPC service to bind to 0.0.0.0 or other publicly accessible network interfaces upon restart.\nThe attack flow follows these steps: 1) The attacker authenticates to the x-ui panel; 2) The attacker navigates to the settings interface to inject malicious parameters into the xray configuration template; 3) The attacker triggers a panel restart, which restarts the xray management gRPC service using the tainted configuration; 4) The service restarts, binding the gRPC port to non-loopback addresses; 5) The attacker gains remote access to the gRPC management interface from external network segments.\nThis manipulation effectively circumvents the security boundaries established by the panel, allowing remote commands to be sent directly to the xray core without passing through the x-ui web application layer.\nThe vulnerability is specific to version 0.3.2 and impacts any deployment where authenticated users possess permission to access the settings interface.\nThe post-exploitation impact includes full control over the xray core, as the gRPC service typically provides elevated management capabilities that, once exposed to the network, can be exploited without further authentication, depending on the xray configuration settings."
}