CVE-2026-45563: Roxy-WI Audit Trail Disclosure – Unauthorized Access to User History

Technical summary

The vulnerability exists in the GET /history/<service>/<server_ip> endpoint. When the service parameter is set to 'user', Roxy-WI incorrectly interprets the server_ip path parameter as a user ID and returns that user's complete action audit log without performing any authorization check. The application relies solely on the fact that the user is authenticated, not on whether that user has permission to access a specific user's history. An attacker with any valid login—including low-privilege guest accounts—can enumerate other user IDs and retrieve their audit trails by manipulating the endpoint parameter. The issue stems from insufficient access control (CWE-863) combined with improper authorization resource mapping (CWE-639).

Business impact

For organizations using Roxy-WI to manage critical load balancing and web infrastructure, this vulnerability creates an insider threat amplifier. A disgruntled or compromised low-privilege account can conduct detailed reconnaissance of administrative activity—identifying who manages which systems, discovering patterns in deployment schedules, and documenting the full scope of what individual admins can access. This reconnaissance can inform lateral movement, privilege escalation, or social engineering attacks. Compliance frameworks (PCI-DSS, SOC 2, HIPAA) that require audit trail confidentiality may be violated. The exposure also undermines accountability by allowing unauthorized visibility into who performed what actions and when.

Affected systems

Roxy-WI version 8.2.6.4 and all prior versions are vulnerable. Roxy-WI is used to centrally manage configurations and operations for HAProxy, Nginx, Apache, and Keepalived servers, so the scope of impact depends on an organization's deployment footprint. Any organization relying on Roxy-WI for multi-server load balancing or web server orchestration is affected if they have not yet upgraded. The vendor has not released patches as of the publication date.

Exploitability

Exploitation is straightforward. An attacker needs only a valid Roxy-WI login credential—which may be obtained through credential compromise, default accounts, or legitimate but low-privilege guest access. No special tools or network positioning are required; the attack is a simple HTTP GET request from an authenticated session. The CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity and no user interaction required, but limited scope (confidentiality only, no integrity or availability impact). However, the ease of exploitation and the informational sensitivity of audit trails make this a practical concern even at MEDIUM severity.

Remediation

At publication, no official patches are available from the Roxy-WI vendor. Organizations should immediately review their access controls and audit logging for evidence of unauthorized history queries. Contact your Roxy-WI vendor to request patching timeline and interim workarounds. In the interim, consider network-layer access controls to restrict who can reach the Roxy-WI management interface, and monitor for suspicious /history endpoint access patterns. Reduce the number of users with Roxy-WI access to the minimum necessary. Verify the vendor's advisory and patch availability before deploying any update.

Patch guidance

Monitor the Roxy-WI project repository and vendor advisories for patch releases. When patches become available, verify the version number and release notes carefully—particularly confirm that the /history endpoint now enforces proper authorization checks. Test patches in a non-production environment before rollout. Because no patch is currently available, document your Roxy-WI version and prioritize upgrade planning once a vendor release is announced. Subscribe to the vendor's security notification channels to receive immediate notification of available fixes.

Detection guidance

In Roxy-WI logs or your WAF/reverse proxy in front of it, search for GET requests to /history/user/* endpoints, particularly those originating from unexpected user sessions or IP addresses. Look for repeated or sequential user ID enumeration attempts (e.g., /history/user/1, /history/user/2, etc.). Compare the user making the request to the user ID being queried—legitimate use should typically involve users querying their own history. Elevated audit trail queries by guest or low-privilege accounts are a strong indicator of abuse. Enable detailed request logging if it is not already active.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability merits prompt attention because audit trail confidentiality is a foundational security control. Unauthorized visibility into administrative actions can enable social engineering, reconnaissance for lateral movement, and compliance violations. The ease of exploitation—requiring only an authenticated session—makes it a low-barrier attack for insiders or accounts compromised by phishing. Organizations managing sensitive infrastructure (e-commerce, banking, healthcare) should treat this as a near-term priority until patches are available and deployed.

Risk score, explained

CVSS 3.1 score of 4.3 reflects: Attack Vector Network (AV:N), Attack Complexity Low (AC:L), Privileges Required for Login (PR:L), User Interaction None (UI:N), Scope Unchanged (S:U), and Confidentiality Impact Low (C:L) with no Integrity or Availability impact (I:N, A:N). The MEDIUM rating acknowledges that exploitation is simple and requires only authentication, but impact is limited to disclosure of audit history. The practical risk is amplified by the sensitive nature of the disclosed information and its utility in planning further attacks, though the CVSS vector itself does not account for those downstream risks.

Frequently asked questions