CVE-2026-45550: Roxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body

Synopsis

This is an Insecure Direct Object Reference (IDOR) vulnerability in Roxy-WI, a web management interface for HAProxy, Nginx, Apache, and Keepalived. The PUT /smon/check endpoint accepts a monitoring check ID without verifying that the requesting user belongs to the tenant that owns that check, meaning any authenticated user can overwrite monitoring configuration belonging to other tenants by simply iterating over integer check IDs. Successful exploitation lets an attacker silently corrupt HTTP, TCP, Ping, and DNS monitoring checks across any tenant in the same Roxy-WI deployment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Roxy-WI web interface over the network; the AV:N vector token confirms this is remotely exploitable without physical or local access.

• AuthenticationRequired

  A valid account with any group membership is sufficient; the PR:L token confirms that low-privilege credentials, not administrator access, are all that is needed.

• Victim interactionNot required

  No action from another user or tenant is needed; the attacker sends the crafted PUT request directly and the overwrite takes effect immediately.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; the AC:L token indicates no race conditions, special memory layout, or environmental prerequisites are involved beyond knowing or guessing integer smon_id values.

Blast Radius

• An attacker rewrites the target URL, IP address, or request body of any tenant's HTTP, TCP, Ping, or DNS monitoring check, causing those checks to silently monitor an attacker-controlled or incorrect endpoint.
• Falsified monitoring checks mask real service outages for victim tenants, delaying incident detection and response.
• Redirecting checks to attacker-controlled endpoints leaks behavioral metadata such as check frequency, source IP ranges of the monitoring agent, and expected response patterns (limited confidentiality impact per C:L).
• Persistent corruption of monitoring configuration degrades the availability and reliability of the Roxy-WI monitoring subsystem for affected tenants (A:L per CVSS).