CVE-2026-45550: Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PUT /smon/check (app/routes/smon/routes.py:117-138) gates only on roxywicommon.checkusergroupforflask() — which validates that the caller has some group, not that the target checkid belongs to it. The downstream SQL update functions updatesmon, updatesmonHttp, updatesmonTcp, updatesmonPing, updatesmonDns (app/modules/db/smon.py:515-562) all execute WHERE smonid = ? with no usergroup filter. The DELETE path is correctly filtered (app/modules/db/smon.py:319-327 does WHERE id = ? AND usergroup = ?), demonstrating that the maintainers know the right pattern but did not apply it on UPDATE. Therefore any authenticated user can iterate over smonid values and silently rewrite any other tenant's HTTP / TCP / Ping / DNS monitoring check. At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the PUT /smon/check route verifies that the target smon_id belongs to the caller's group (not just that the caller has a group). Update the downstream update functions update_smon, update_smonHttp, update_smonTcp, update_smonPing, update_smonDns (app/modules/db/smon.py) to include a user_group restriction in the WHERE clause (e.g. use the same pattern as the DELETE path which does WHERE id = ? AND user_group = ?). Apply the check at the route level and in each UPDATE SQL statement to prevent cross-tenant updates.
Roxy-WI (app/routes/smon/routes.py and app/modules/db/smon.py) smon update authorization / SQL filter = require user_group match for UPDATE operations - Compensating control
Until code is fixed, restrict access to the management interface and PUT /smon/check: limit access to trusted management IP ranges or VPNs at the network/firewall level, and restrict application roles that can call smon update endpoints to trusted admin users only.
- Operational
Audit smon monitoring entries for unauthorized changes (review logs for PUT /smon/check calls and iterate over smon_id access), restore any altered checks from backups or known-good configuration, and notify affected tenants of potential unauthorized modifications.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45550?
CVE-2026-45550 has a critical severity score of 9.1.
How do I fix CVE-2026-45550?
To fix CVE-2026-45550, upgrade Roxy-WI to version 8.2.6.5 or later.
What systems are affected by CVE-2026-45550?
CVE-2026-45550 affects Roxy-WI versions 8.2.6.4 and prior.
What is the impact of CVE-2026-45550?
CVE-2026-45550 allows any user to overwrite a tenant's monitoring URL, IP, or body.
What type of vulnerability is CVE-2026-45550?
CVE-2026-45550 is an Insecure Direct Object Reference (IDOR) vulnerability.