Roxy-WI Missing Authorization on Install Endpoints

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/routes/install/routes.py:36-39). The individual endpoints install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, and get_task_status are not wrapped in page_for_admin and do not call roxywi_common.is_user_has_access_to_its_group(server_ip) or check_is_server_in_group(server_ip). Only the GET index page (install_monitoring) gates on roxywi_auth.page_for_admin(level=2). Because the missing decorators omit both role and group checks, any logged-in user — including the default guest role 4 — can install/reconfigure exporters, WAF, and GeoIP databases on every server in the Roxy-WI database, regardless of tenant ownership. The Ansible playbooks run with the per-server SSH credential stored in Roxy-WI, which the credentials' rightful owner (a different tenant) has provisione

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Roxy-WI versions 8.2.6.4 and earlier contain a critical authorization bypass vulnerability affecting web-based management interfaces for HAProxy, Nginx, Apache, and Keepalived servers. While the install blueprint implements JWT authentication at the request level, six critical endpoints (install_exporter, install_waf, install_geoip, check_geoip, get_exporter_version, get_task_status) lack proper authorization checks. These endpoints do not verify user permissions through page_for_admin decorators or group access validation, allowing authenticated users to bypass intended access controls and perform privileged operations. Organizations running Roxy-WI in production environments face immediate risk of unauthorized infrastructure modifications, potentially enabling attackers to deploy malicious WAF rules, manipulate geolocation services, or compromise monitoring capabilities across their server estate.

Casky's 261 mapped security skills detect this vulnerability pattern by analyzing authorization bypass indicators across MITRE ATT&CK tactics TA0004 (Privilege Escalation) and TA0006 (Credential Access). Claude AI's extended reasoning identifies the signature weakness: authentication present but authorization absent—a CWE-862 pattern where access controls fail to enforce at the endpoint level (CWE-639 authorization bypass, CWE-863 incorrect authorization). Practitioners using Casky would see findings highlighting missing decorators on install endpoints, absence of group membership validation calls, and JWT token acceptance without downstream permission checks. The detection surfaces the gap between request-level authentication and application-level authorization, enabling teams to immediately prioritize remediation of the six unprotected endpoints and implement consistent authorization patterns across their Roxy-WI deployments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-45552.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-45552

Casky has 261 skills that investigate the attack patterns behind CVE-2026-45552. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn