PatchSiren cyber security CVE debrief

CVE-2026-45550 roxy-wi CVE debrief

CVE-2026-45550 is a critical vulnerability in Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The vulnerability allows any authenticated user to silently rewrite any other tenant's HTTP / TCP / Ping / DNS monitoring check. This is due to a flawed authorization mechanism in the PUT /smon/check endpoint, which fails to validate that the target check_id belongs to the caller. Specifically, the roxywi_common.check_user_group_for_flask() function only checks if the caller has some group, not that the target check_id is within that group. The downstream SQL update functions (update_smon, update_smonHttp, update_smonTcp, update_smonPing, update_smonDns) execute with a WHERE smon_id = ? filter, but without a user_group filter. The DELETE path, however, is correctly filtered. At the time of publication, there are no publicly available patches.