Roxy-WI, a web interface for managing load balancers and web servers, contains an IDOR flaw on the PUT /smon/check endpoint. The authentication check only verifies that the caller belongs to any group, but it does not confirm that the specific smon_id being updated is owned by that group. Consequently, an authenticated user can iterate through smon_id values and silently overwrite the monitoring configuration of another tenant, changing URLs, IPs, or monitoring parameters. This bypass violates confidentiality, integrity, and availability of other tenants’ monitoring services and could be used to disrupt services or plant malicious endpoints.

The affected vendor is Roxy-WI, current until at least version 8.2.6.4. The IDOR exists in all releases prior to that version; higher versions are not mentioned as patched. Therefore any deployment of Roxy-WI 8.2.6.4 or older is exposed.

The CVSS score of 9.1 classifies the vulnerability as critical. The EPSS score is not available, so the current exploitation likelihood is unknown, but the flaw requires only authenticated access and no special network privileges. There is no known public exploit yet and the vulnerability is not listed in the CISA KEV catalog. Attackers could abuse this by enumerating smon_id values and issuing legitimate authenticated requests to update checks for other tenants, bypassing group ownership checks. Because the bug omits a user_group filter on UPDATE statements, the exploit path is straightforward once credentials are obtained.