What is the CVSS score of EUVD-2026-36035?

EUVD-2026-36035 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Roxy-WI are affected by EUVD-2026-36035?

Roxy-WI versions 8.2.6.4 and prior contain a critical cross-tenant privilege escalation vulnerability (CVSS 9.9) allowing any authenticated user-including default guest accounts-to install or…

How to fix or mitigate EUVD-2026-36035?

Within 24 hours: Inventory all Roxy-WI installations and versions; disable default guest role 4 accounts; implement network-level access controls to installer endpoints. Within 7 days: Audit Roxy-WI access logs for suspicious installer endpoint activity; enumerate SSH credentials stored within Roxy-WI and assess exposure. Within 30 days: Monitor vendor for patch availability; if no patch released, plan migration to alternative management solution with proper access controls.

Roxy-WI EUVD-2026-36035

| CVE-2026-45552 CRITICAL

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-10 GitHub_M

Authentication Bypass Apache Nginx Roxy Wi

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:11 vuln.today

CVE Published

Jun 10, 2026 - 13:59 nvd

CRITICAL 9.9

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user - including the default guest role 4 - can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisioned with sudo rights for the management workflow. At time of publication, there are no publicly available patches.

Articles & Coverage 4

News 9 New Nginx Vulnerabilities - 4 Critical, 5 High Severity Patched Jun 11, 2026 News 12 New Apache Vulnerabilities - 6 Critical, 6 High Severity Jun 11, 2026 News 11 New Apache Vulnerabilities - 4 Critical, 7 High Severity Jun 10, 2026 News Critical Privilege Escalation in Roxy-WI (Nginx) - CVE-2026-45552 Jun 10, 2026

AnalysisAI

Privilege escalation and cross-tenant compromise in Roxy-WI versions 8.2.6.4 and prior allows any authenticated user - including the default guest role 4 - to install or reconfigure exporters, WAF, and GeoIP databases on every managed server regardless of tenant ownership. Because the affected installer endpoints lack role and group decorators, low-privilege users can pivot through stored SSH credentials with sudo to achieve root-level command execution on HAProxy/Nginx/Apache hosts belonging to other tenants. No public exploit identified at time of analysis, but the issue is unpatched and rated CVSS 9.9.

Technical ContextAI

Roxy-WI is a Python/Flask web UI for managing HAProxy, Nginx, Apache, and Keepalived. The install blueprint at app/routes/install/routes.py:36-39 declares authentication globally with bp.before_request → @jwt_required(), but only the GET index page (install_monitoring) is additionally guarded by roxywi_auth.page_for_admin(level=2). The action endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status omit both the page_for_admin decorator and calls to roxywi_common.is_user_has_access_to_its_group(server_ip) / check_is_server_in_group(server_ip). This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) - the server_ip parameter is trusted without verifying that the requesting tenant owns it. Once invoked, Roxy-WI dispatches Ansible playbooks using the per-server SSH credential stored in its database, which the legitimate owner has granted sudo rights for management automation.

RemediationAI

No vendor-released patch identified at time of analysis - the GitHub advisory GHSA-v3f8-g2v8-jq5h (https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-v3f8-g2v8-jq5h) confirms no public fix is available as of publication, so operators should monitor the advisory and the roxy-wi repository for an updated release above 8.2.6.4. Until a patched version ships, restrict the Roxy-WI web interface to trusted administrators only by removing or downgrading any guest (role 4) and non-admin accounts, disabling self-registration, and placing the UI behind a network ACL or VPN so only the platform team can reach it (trade-off: ends self-service for any legitimate low-privilege users). As a code-level workaround, operators comfortable patching locally can edit app/routes/install/routes.py to add @page_for_admin(level=2) and an is_user_has_access_to_its_group(server_ip) / check_is_server_in_group(server_ip) call to install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status (trade-off: forks the codebase and must be re-applied on upgrade). If the deployment is single-tenant, rotating per-server SSH credentials and reducing sudo scope on managed hosts limits blast radius should an account be compromised.