CVE-2026-45563

Severity CVSS v4.0:

Pending analysis

Type:

Unavailable / Other

Publication date:

10/06/2026

Last modified:

10/06/2026

Description

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history// re-uses the server_ip path parameter as a user-id when service == &#39;user&#39;, with no authorization check. Any authenticated user — even a guest in an unrelated group — can list any other user&#39;s full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS v3.1 Severity and Metrics:

Base Score: 4.30 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): Low
Integrity (I): None
Availability (A): None

Base Score 3.x

4.30

Severity 3.x

MEDIUM

CVE-2026-45563

Description

Impact

References to Advisories, Solutions, and Tools