PT-2026-48441 · Roxy-Wi · Roxy-Wi

Published 2026-06-10 · Updated 2026-06-10 · CVE-2026-45563

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history// re-uses the server ip path parameter as a user-id when service == 'user', with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user's full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

Fix

IDOR

Incorrect Authorization

Weakness Enumeration

CWE-639

CWE-863

Related Identifiers

CVE-2026-45563

Affected Products

Roxy-Wi

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-45563 · Security Note
• https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9 · Note