CVE-2026-45563CWE-639CWE-863

Roxy-WI: IDOR — any authenticated user can read another user's full action history

Medium · published June 10, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.8
In the wild
Unconfirmed
What it is

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/<service>/<server_ip> re-uses the server_ip path parameter as a user-id when service == 'user', with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user's full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00294 · 20.8th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-863 · Incorrect Authorization
Published
2026-06-10T14:03Z
EPSS history
Timeline
  • 10 JUN 14:03Z
    Roxy-WI: IDOR — any authenticated user can read another user's full action history
    cvelistv5