Executive brief
Roxy-WI, a management interface for popular web servers like HAProxy and Nginx, contains a security flaw in its monitoring component. An authenticated user can modify or redirect the monitoring checks belonging to other organizations or users. This allows an attacker to disable alerts for critical services or redirect monitoring traffic to capture sensitive information like API keys, potentially leading to undetected service outages.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the PUT /smon/check endpoint of Roxy-WI versions 8.2.6.4 and prior. While the application verifies that a user belongs to a group, it fails to verify that the specific 'check_id' being updated belongs to the user's group. The underlying SQL update functions in 'app/modules/db/smon.py' lack a 'user_group' filter in their WHERE clauses. An authenticated attacker can iterate through check IDs to silently rewrite HTTP, TCP, Ping, or DNS monitoring configurations for any tenant. This can be used to exfiltrate data via OAST, perform DoS amplification, or mask service outages. As of publication, no official patches are available.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: NVD publication date