Main Vulnerability Database Exploits ID:12980 - Exploit for Missing Authorization in Roxy-WI

ID:12980 - Exploit for Missing Authorization in Roxy-WI

Published: August 31, 2026

Vulnerability identifier: #VU146316

Vulnerability risk: Medium

CVE-ID: N/A

CWE-ID: CWE-862

Exploitation vector: Remote access

Vulnerable software:
Roxy-WI

Link to public exploit:

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing authorization within PATCH /user/id/groups/gid. A remote user can become superAdmin.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.