Skip to content
Heist/ feed
Back to feed
Critical

Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server

Type: advisorySources: OSV

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user — including the default guest role 4 — can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-45552
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 01:17 UTC · Revision 1

Source evidence

Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server

core-osv · Original source

Published 10 Jun 2026, 13:59 UTC

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user — including the default guest role 4 — can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.

osv:CVE-2026-45552
Complete source record
{
  "id": "d310d4aeb05f39948df888d03cfd1b2e8e5b6c0719f50f8d467b27224ba4126d",
  "url": "https://osv.dev/vulnerability/CVE-2026-45552",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Roxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server",
    "summary": "Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user — including the default guest role 4 — can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.",
    "evidence": "osv:CVE-2026-45552",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-45552",
      "aliases": [
        "CVE-2026-45552",
        "GHSA-v3f8-g2v8-jq5h"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/roxy-wi/roxy-wi",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "d72ea494d0bf1ee220fe141625a4298600f624ad"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "8.2.6.4"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "8.2.6.4"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v8.2.6.4",
            "v8.2.6.3",
            "v8.2.8.2",
            "v8.2.8.1",
            "v8.2.6",
            "v8.2.5",
            "v8.2.4",
            "v8.2.3",
            "v8.2.2",
            "v8.2.1",
            "v8.2.0",
            "v8.1.8",
            "v8.1.7",
            "v8.1.6",
            "v8.1.5",
            "v8.1.4",
            "v8.1.3",
            "v8.1.2",
            "v8.1.1",
            "v8.1.0.1",
            "v8.1",
            "v8.0.2",
            "v8.0.1",
            "v8.0",
            "v7.3.2.0",
            "v7.3.1.0",
            "v7.3.0.0",
            "v7.2.6.0",
            "v7.2.5.0",
            "v7.2.4.0",
            "v7.2.3.0",
            "v7.2.2.0",
            "v7.2.1.0",
            "v7.2.0.0",
            "v7.1.2.0",
            "v7.1.1.0",
            "v7.1.0.0",
            "v7.0.4.0",
            "v7.0.3.0",
            "v7.0.2.0",
            "v7.0.1.0",
            "v7.0.0.0",
            "v6.3.19.0",
            "v6.3.18.0",
            "v6.3.17.0",
            "v6.3.16.0",
            "v6.3.15.0",
            "v6.3.14.0",
            "v6.3.13.0",
            "v6.3.12.0",
            "v6.3.11.0",
            "v6.3.10.0",
            "v6.3.9.0",
            "v6.3.8.0",
            "v6.3.7.0",
            "v6.3.6.0",
            "v6.3.5.0",
            "v6.3.4.0",
            "v6.3.3.0",
            "v6.3.2.0",
            "v6.3.1.0",
            "v6.3.0.0",
            "v6.2.3.0",
            "v6.2.2.0",
            "v6.2.1.0",
            "v6.2.0.0",
            "v6.1.5.0",
            "v6.1.4.0",
            "v6.1.3.0",
            "v6.1.2.0",
            "v6.1.1.0",
            "v6.1.0.0",
            "v6.0.3.0",
            "v6.0.2.0",
            "v6.0.1.0",
            "v6.0.0.0",
            "v5.5.1.0",
            "v5.5.0.0",
            "v5.4.3.0",
            "v5.4.2.0",
            "v5.4.1.0",
            "v5.4.0.0",
            "v5.3.6.0",
            "v.5.3.5.0",
            "v5.3.4.0",
            "v5.3.3.0",
            "v5.3.2.0",
            "v5.3.1.0",
            "v5.3.0.0",
            "v5.2.6.0",
            "v5.2.5.0",
            "v5.2.4.0",
            "v5.2.3.0",
            "v5.2.2.0",
            "v5.2.1",
            "v5.2.0",
            "v5.1.4.0",
            "v5.1.1.0",
            "v4.4.1.0",
            "3.4.5.1",
            "3.4.5",
            "3.4.4.7",
            "3.4.4.6",
            "v3.3",
            "v3.2.13",
            "v2.0.2",
            "v1.10.2.1",
            "v1.10.2",
            "v1.10.1",
            "v1.10",
            "v1.9.1",
            "v1.6",
            "v1.4.1",
            "v1.4",
            "v1.3",
            "v1.1",
            "v1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45552.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.404902340Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45552.json",
        "https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-v3f8-g2v8-jq5h",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-45552"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639",
          "CWE-862",
          "CWE-863"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45552.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-45552",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521270,
  "published_at": "2026-06-10T13:59:24.337+00:00"
}