Executive Summary

CVE-2026-45549 is an authorization bypass vulnerability in Roxy-WI versions up to 8.2.6.4. The issue exists in the agent_action function at the POST /smon/agent/action/<action> endpoint, which lacks proper role and group ownership checks. This means any authenticated user, including guests, can start, stop, or restart the roxy-wi-smon-agent systemd unit on any server by specifying its IP address.

Because Roxy-WI executes these commands over SSH with passwordless sudo privileges, the actions run as root on the target server. This allows an attacker to perform privileged operations remotely without proper authorization.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to significant impacts including denial-of-service (DoS) attacks across tenants. An attacker can silently disable monitoring on a victim's server by stopping the smon-agent, which halts status event reporting.

Since the commands run as root on the target server, the attacker gains high availability impact by disrupting critical monitoring services. The vulnerability has a CVSS score of 8.5 (High), indicating it is a serious threat with low complexity to exploit and no need for user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized POST requests to the /smon/agent/action/<action> endpoint on Roxy-WI servers running version 8.2.6.4 or earlier.

Specifically, look for POST requests from authenticated users, including those with guest roles, attempting to start, stop, or restart the roxy-wi-smon-agent systemd unit by specifying server IP addresses.

Network or application logs can be searched for such suspicious POST requests.

Suggested commands to detect this activity include using tools like curl or wget to simulate or monitor such requests, or using log analysis commands such as:

• grep -i 'POST /smon/agent/action/' /var/log/nginx/access.log
• grep -i 'agent/action' /path/to/roxy-wi/logs/*
• tcpdump or Wireshark filters to capture HTTP POST requests to /smon/agent/action/

Additionally, monitoring systemd logs on target servers for unexpected start, stop, or restart commands of the roxy-wi-smon-agent service may help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /smon/agent/action/<action> endpoint to trusted users only, as the vulnerability allows any authenticated user, including guests, to control the roxy-wi-smon-agent service.

Since no public patches are available at the time of publication, consider implementing network-level controls such as firewall rules or web application firewall (WAF) rules to block unauthorized POST requests to this endpoint.

Review and limit user roles and permissions within Roxy-WI to minimize the number of users who can authenticate and access this functionality.

Monitor systemd service status for the roxy-wi-smon-agent on all managed servers to detect unexpected stops or restarts.

Plan to apply proper authorization checks in the application by adding decorators such as @get_user_params(), @page_for_admin(level=2), and @check_is_server_in_group() once patches become available.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Roxy-WI allows any authenticated user, including guests, to execute system-level commands as root on target servers, potentially causing denial-of-service by stopping monitoring agents. This unauthorized control and disruption of system availability can lead to non-compliance with standards and regulations that require strict access controls, integrity, and availability of systems and data.

Specifically, regulations like GDPR and HIPAA mandate protecting the integrity and availability of personal and sensitive data. The ability for low-privilege users to disrupt monitoring and management services could hinder detection of malicious activity and system failures, thereby increasing risk of data breaches or loss of data availability.

Therefore, this vulnerability represents a failure in proper authorization controls (CWE-862, CWE-863), which is critical for compliance with such standards.

Useful 0 Not Useful 0