What is the CVSS score of CVE-2026-45563?

CVE-2026-45563 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Roxy-WI CVE-2026-45563

EUVD-2026-36043 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-10 GitHub_M

Authentication Bypass Nginx Apache

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:30 vuln.today

CVE Published

Jun 10, 2026 - 14:03 nvd

MEDIUM 4.3

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/<service>/<server_ip> re-uses the server_ip path parameter as a user-id when service == 'user', with no authorization check. Any authenticated user - even a guest in an unrelated group - can list any other user's full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

AnalysisAI

Roxy-WI 8.2.6.4 and prior exposes a broken object-level authorization flaw in its audit history endpoint, allowing any authenticated user to read any other user's full action audit trail. The GET /history/user/<server_ip> endpoint conflates the server_ip path parameter with a user identifier and performs no authorization check, meaning a guest account in an unrelated group can enumerate administrators' operational history including server IPs touched, configs deployed, and services restarted. No patch is available at time of publication; no public exploit code or active exploitation has been identified.

Technical ContextAI

Roxy-WI is a web-based management interface for infrastructure services including HAProxy, Nginx, Apache, and Keepalived, identified by CPE cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*. The vulnerable endpoint GET /history/<service>/<server_ip> is designed for server-scoped history lookups, but when the service parameter equals 'user', the application repurposes the server_ip path segment as a user identifier for database lookup without validating whether the requesting session has rights to view that user's records. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) flaw: the application trusts a caller-supplied value to select a sensitive resource without enforcing access control, bypassing the group-based authorization model used elsewhere in the application.

RemediationAI

No vendor-released patch has been identified at time of publication - the CVE description explicitly states no publicly available patches exist, and this is corroborated by the absence of a fix version in the advisory reference. The GitHub Security Advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9 should be monitored for patch availability. As immediate compensating controls: first, audit and remove unnecessary low-privilege and guest accounts that have no legitimate operational need within the Roxy-WI instance, reducing the authenticated attacker surface. Second, restrict network-level access to the Roxy-WI interface via firewall rules or reverse-proxy ACLs so only trusted management IPs can reach it - this limits who can obtain the required authenticated session. Third, if a WAF or reverse proxy is in front of Roxy-WI, consider blocking or alerting on GET requests matching /history/user/* from non-administrative session tokens. The trade-off of network restriction is reduced accessibility for remote administrators; the trade-off of guest account removal is reduced usability for read-only monitoring users.