What is the CVSS score of CVE-2026-45552?

CVE-2026-45552 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Roxy-WI are affected by CVE-2026-45552?

Roxy-WI versions 8.2.6.4 and prior contain a critical cross-tenant privilege escalation vulnerability (CVSS 9.9) allowing any authenticated user-including default guest accounts-to install or…

How to fix or mitigate CVE-2026-45552?

Within 24 hours: Inventory all Roxy-WI installations and versions; disable default guest role 4 accounts; implement network-level access controls to installer endpoints. Within 7 days: Audit Roxy-WI access logs for suspicious installer endpoint activity; enumerate SSH credentials stored within Roxy-WI and assess exposure. Within 30 days: Monitor vendor for patch availability; if no patch released, plan migration to alternative management solution with proper access controls.

Roxy-WI CVE-2026-45552

EUVD-2026-36035 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-10 GitHub_M

Authentication Bypass Nginx Apache

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:11 vuln.today

CVE Published

Jun 10, 2026 - 13:59 nvd

CRITICAL 9.9

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user - including the default guest role 4 - can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.

Articles & Coverage 4

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026 News Critical Privilege Escalation in Roxy-WI (Nginx) - CVE-2026-45552 Jun 10, 2026

AnalysisAI

Privilege escalation and cross-tenant compromise in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - including the default guest role 4 - to install or reconfigure exporters, WAF, and GeoIP databases on every managed server regardless of tenant ownership. Because the affected installer endpoints lack role and group decorators, low-privilege users can pivot through stored SSH credentials with sudo to achieve root-level command execution on HAProxy/Nginx/Apache hosts belonging to other tenants. No public exploit identified at time of analysis, but the issue is unpatched and rated CVSS 9.9.

Technical ContextAI

Roxy-WI is a Python/Flask web UI for managing HAProxy, Nginx, Apache, and Keepalived. The install blueprint at app/routes/install/routes.py:36-39 declares authentication globally with bp.before_request → @jwt_required(), but only the GET index page (install_monitoring) is additionally guarded by roxywi_auth.page_for_admin(level=2). The action endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status omit both the page_for_admin decorator and calls to roxywi_common.is_user_has_access_to_its_group(server_ip) / check_is_server_in_group(server_ip). This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) - the server_ip parameter is trusted without verifying that the requesting tenant owns it. Once invoked, Roxy-WI dispatches Ansible playbooks using the per-server SSH credential stored in its database, which the legitimate owner has granted sudo rights for management automation.

RemediationAI

No vendor-released patch identified at time of analysis - the GitHub advisory GHSA-v3f8-g2v8-jq5h (https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-v3f8-g2v8-jq5h) confirms no public fix is available as of publication, so operators should monitor the advisory and the roxy-wi repository for an updated release above 8.2.6.4. Until a patched version ships, restrict the Roxy-WI web interface to trusted administrators only by removing or downgrading any guest (role 4) and non-admin accounts, disabling self-registration, and placing the UI behind a network ACL or VPN so only the platform team can reach it (trade-off: ends self-service for any legitimate low-privilege users). As a code-level workaround, operators comfortable patching locally can edit app/routes/install/routes.py to add @page_for_admin(level=2) and an is_user_has_access_to_its_group(server_ip) / check_is_server_in_group(server_ip) call to install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status (trade-off: forks the codebase and must be re-applied on upgrade). If the deployment is single-tenant, rotating per-server SSH credentials and reducing sudo scope on managed hosts limits blast radius should an account be compromised.