In Roxy‑WI versions 8.2.6.4 and earlier the install blueprint incorrectly omits role and tenant checks for several endpoints; any logged‑in user, including the default guest role, can invoke these endpoints which trigger Ansible playbooks that run with per‑server SSH credentials. Because the credentials belong to a different tenant and typically provide sudo access, an attacker can execute arbitrary commands on any server registered in the Roxy‑WI database, bypassing tenant boundaries. The flaw arises from missing decorators that enforce both role and group checks, leading to a severe privilege escalation vulnerability classified as remote code execution (CWE-639, CWE-862, CWE-863).

The affected product is Roxy‑WI, an interface for managing Haproxy, Nginx, Apache, and Keepalived servers. The flaw exists in versions 8.2.6.4 and all earlier releases. Any user registered in the Roxy‑WI platform, especially the default guest role, can exploit the vulnerability regardless of tenant ownership. No specific operating system is tied to the issue; the impact is on any server provisioned through Roxy‑WI.

The CVSS score of 9.9 indicates critical severity, and although the EPSS score is not available, the lack of a patch or workaround and the ability to run privileged commands on arbitrary servers make this a high‑risk vulnerability. The vulnerability is not listed in the CISA KEV catalog, but the potential for widespread exploitation remains. An attacker only needs authenticated access to the web interface; no auxiliary conditions or elevated privileges are required beyond those of a logged‑in user.