Checklist
- Have you pulled and found the error with
jc21/nginx-proxy-manager:latest docker image?
- Are you sure you're not using someone else's docker image?
- Have you searched for similar issues (both open and closed)?
Describe the bug
The project documentation indicates that "Advanced Nginx configuration" is intended for super-user access only, and the system includes user management, permissions, and audit logging capabilities.In reality, any authenticated standard (non-admin) user authorized to manage Proxy Hosts / Redirection Hosts / 404 Hosts can abuse the "Custom Nginx Configuration" feature to inject raw Nginx directives.
Nginx Proxy Manager Version
v2.15.1
To Reproduce
Steps to reproduce the behavior:
- Go to '...'
- Click on '....'
- Scroll down to '....'
- See error
Expected behavior
advanced_config should be restricted per the documentation ("super users"): enforce an admin-only check at the API layer for create/update payloads containing advanced_config on all host types, or introduce a dedicated permission flag for raw nginx configuration.
New users should not receive manage on every section by default (least privilege).
Screenshots
Operating System
Additional context
Checklist
jc21/nginx-proxy-manager:latestdocker image?Describe the bug
The project documentation indicates that "Advanced Nginx configuration" is intended for super-user access only, and the system includes user management, permissions, and audit logging capabilities.In reality, any authenticated standard (non-admin) user authorized to manage Proxy Hosts / Redirection Hosts / 404 Hosts can abuse the "Custom Nginx Configuration" feature to inject raw Nginx directives.
Nginx Proxy Manager Version
v2.15.1
To Reproduce
Steps to reproduce the behavior:
Expected behavior
advanced_config should be restricted per the documentation ("super users"): enforce an admin-only check at the API layer for create/update payloads containing advanced_config on all host types, or introduce a dedicated permission flag for raw nginx configuration.
New users should not receive manage on every section by default (least privilege).
Screenshots
Operating System
Additional context