Executive brief
Roxy-WI is a management interface used to configure and monitor web servers like HAProxy, Nginx, and Apache. A security flaw allows any logged-in user, even those with the lowest "guest" permissions, to execute administrative tasks on any server managed by the system. This could allow an attacker to reconfigure load balancers, install unauthorized software, or view sensitive directory listings across different customer accounts, potentially leading to a full takeover of the managed infrastructure.
Technical details
A missing authorization check in 'app/routes/install/routes.py' allows authenticated users to access administrative endpoints without proper role or group validation. While the blueprint requires a valid JWT, individual endpoints such as 'install_exporter', 'install_waf', and 'check_geoip' fail to implement 'page_for_admin' decorators or group-membership checks. An attacker can leverage this to trigger Ansible playbooks that run with stored sudo-level SSH credentials or execute arbitrary 'ls' commands via the 'check_geoip' route. This results in a cross-tenant bypass where a user in one group can modify or probe servers belonging to an entirely different tenant. As of publication, no official patches are available.
Affected products
- Roxy-WI Roxy-WI <= 8.2.6.4
Timeline
- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD