CVE-2026-45563: Roxy-WI: IDOR — any authenticated user can read another user's full action history
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/<service>/<serverip> re-uses the serverip path parameter as a user-id when service == 'user', with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user's full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Roxy-WIfrom your environment.If Roxy-WI is not required for operations, uninstall or take the application offline until an official security fix is released.
- Configuration
Prevent reuse of the server_ip path parameter as a user-id by restricting access to the /history endpoint: require that only authorized administrator accounts can call GET /history/* (or disable the 'user' history retrieval) until an upstream fix is available.
Roxy-WI GET /history/<service>/<server_ip> access = restricted to administrators or disabled for service=='user' - Compensating control
Restrict access to the Roxy-WI web interface and the /history endpoint to trusted IP addresses or internal management networks using network ACLs, firewall rules, or a reverse proxy. Ensure only authenticated, authorized management networks can reach the endpoint.
- Operational
Review Roxy-WI access logs for any unauthorized reads of other users' histories, identify affected user accounts, notify impacted users, and investigate any actions discovered in those histories for potential misuse.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45563?
CVE-2026-45563 has a medium severity rating of 4.3.
How do I fix CVE-2026-45563?
To mitigate CVE-2026-45563, ensure you update Roxy-WI to a version later than 8.2.6.4 that includes the necessary authorization checks.
What is the risk associated with CVE-2026-45563?
CVE-2026-45563 poses a risk level of 22, indicating it can allow any authenticated user to access another user's action history.
Who is affected by CVE-2026-45563?
CVE-2026-45563 affects users of Roxy-WI versions 8.2.6.4 and prior, specifically those who can authenticate as any user.
Can guest users exploit CVE-2026-45563?
Yes, even guest users can exploit CVE-2026-45563 due to the lack of proper authorization checks.