CVE-2026-45550
- Source
- https://cve.org/CVERecord?id=CVE-2026-45550
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45550.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-45550
- Aliases
-
- GHSA-856h-mvm2-2h2x
- Published
- 2026-06-10T14:00:06.978Z
- Modified
- 2026-07-15T01:48:59.861385645Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L CVSS Calculator
- Summary
- Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body
- Details
-
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PUT /smon/check (app/routes/smon/routes.py:117-138) gates only on roxywicommon.checkusergroupforflask() — which validates that the caller has some group, not that the target checkid belongs to it. The downstream SQL update functions updatesmon, updatesmonHttp, updatesmonTcp, updatesmonPing, updatesmonDns (app/modules/db/smon.py:515-562) all execute WHERE smonid = ? with no usergroup filter. The DELETE path is correctly filtered (app/modules/db/smon.py:319-327 does WHERE id = ? AND usergroup = ?), demonstrating that the maintainers know the right pattern but did not apply it on UPDATE. Therefore any authenticated user can iterate over smon_id values and silently rewrite any other tenant's HTTP / TCP / Ping / DNS monitoring check. At time of publication, there are no publicly available patches.
- Database specific
{ "cwe_ids": [ "CWE-639", "CWE-862", "CWE-863" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45550.json", "cna_assigner": "GitHub_M" }- References