CVE-2026-45563: Roxy-WI Information Disclosure Flaw

CVE-2026-45563 Overview

CVE-2026-45563 is an Insecure Direct Object Reference (IDOR) vulnerability in Roxy-WI, a web interface for managing HAProxy, Nginx, Apache, and Keepalived servers. The flaw exists in the GET /history/<service>/<server_ip> endpoint, which reuses the server_ip path parameter as a user identifier when service == 'user'. The endpoint performs no authorization check on the supplied identifier. Any authenticated user, including a guest assigned to an unrelated group, can retrieve another user's complete action audit trail. Exposed records include server IPs accessed, configuration deployments, and service restart actions. Roxy-WI versions 8.2.6.4 and prior are affected, and no patch is publicly available at time of publication.

Critical Impact
Authenticated low-privilege users can enumerate the full administrative audit history of any other user, exposing managed server IPs and operational activity.

Affected Products

Roxy-WI versions 8.2.6.4 and prior
The /history/user/<id> endpoint within the Roxy-WI web interface
Multi-tenant Roxy-WI deployments with guest or low-privilege user accounts

Discovery Timeline

2026-06-10 - CVE-2026-45563 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45563

Vulnerability Analysis

The vulnerability is classified as Insecure Direct Object Reference under [CWE-639]. Roxy-WI exposes a history endpoint at GET /history/<service>/<server_ip> to retrieve audit data for managed services. When the <service> segment equals user, the application reinterprets the <server_ip> segment as a user_id and returns that user's audit trail. The server does not verify that the requesting session owns the target identifier or shares a group with the target user. An attacker authenticated as any role, including guest, can iterate through user identifiers and retrieve operational history for every account in the system. Returned data includes server IPs touched, configuration files deployed, and services restarted by the targeted user. This exposes the topology of managed HAProxy, Nginx, Apache, and Keepalived infrastructure and reveals administrator activity patterns useful for follow-on attacks.

Root Cause

The endpoint handler conflates two distinct object types on a single URL parameter and omits an authorization check. Path routing accepts user as a valid value for <service> but does not apply the access-control logic used for server-scoped history queries. No ownership, group membership, or role check gates the response.

Attack Vector

Exploitation requires only network access to the Roxy-WI interface and valid low-privilege credentials. An attacker issues an authenticated GET /history/user/<target_user_id> request, incrementing the identifier to enumerate audit trails. No user interaction is required, and the request resembles legitimate traffic.

No verified proof-of-concept code is published. See the GitHub Security Advisory for upstream technical detail.

Detection Methods for CVE-2026-45563

Indicators of Compromise

Access log entries containing GET /history/user/ requests issued by sessions belonging to guest or non-administrative users.
Sequential numeric enumeration of the trailing path segment in /history/user/<id> from a single session or source IP.
Unexpected HTTP 200 responses to /history/user/<id> requests where <id> does not match the authenticated session's own user ID.

Detection Strategies

Parse Roxy-WI web server access logs and alert on /history/user/ requests where the requesting user role is not admin or superAdmin.
Correlate the requesting session's user ID with the path parameter and flag mismatches as authorization anomalies.
Baseline normal history endpoint usage per role and alert on volume spikes consistent with enumeration.

Monitoring Recommendations

Forward Roxy-WI application and reverse proxy logs to a centralized log platform for retention and correlation.
Monitor for outbound reconnaissance against managed HAProxy, Nginx, Apache, and Keepalived hosts that follows history endpoint access.
Review user and group provisioning events to identify dormant guest accounts that could be abused for authenticated access.

How to Mitigate CVE-2026-45563

Immediate Actions Required

Restrict network access to the Roxy-WI web interface to trusted administrative networks or VPN-bound clients.
Disable or remove guest and unused low-privilege accounts until a patch is released.
Block /history/user/ requests at a reverse proxy for sessions that are not authenticated as administrators.

Patch Information

At time of publication, no official patch is available from the Roxy-WI maintainers. Track the GitHub Security Advisory GHSA-wcmc-cjmw-54x9 for fix availability and upgrade guidance.

Workarounds

Place Roxy-WI behind an authenticating reverse proxy and enforce an allowlist on the /history/ path prefix.
Apply a web application firewall rule that denies GET /history/user/<id> where <id> does not equal the requesting session's user ID.
Audit existing accounts and remove any unnecessary guest, viewer, or cross-group memberships.

bash

# Example NGINX reverse proxy rule restricting the history/user path
location ~ ^/history/user/ {
    # Only allow requests from an internal admin subnet
    allow 10.0.0.0/24;
    deny all;
    proxy_pass http://roxy_wi_upstream;
}