What is the CVSS score of CVE-2026-45563?

CVE-2026-45563 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Roxy-WI CVE-2026-45563

EUVD-2026-36043 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-10 GitHub_M

Authentication Bypass Apache Nginx Roxy Wi

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 15:30 vuln.today

CVE Published

Jun 10, 2026 - 14:03 nvd

MEDIUM 4.3

DescriptionNVD

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GET /history/<service>/<server_ip> re-uses the server_ip path parameter as a user-id when service == 'user', with no authorization check. Any authenticated user - even a guest in an unrelated group - can list any other user's full action audit trail (server IPs touched, configs deployed, services restarted). At time of publication, there are no publicly available patches.

AnalysisAI

Roxy-WI 8.2.6.4 and prior exposes a broken object-level authorization flaw in its audit history endpoint, allowing any authenticated user to read any other user's full action audit trail. The GET /history/user/<server_ip> endpoint conflates the server_ip path parameter with a user identifier and performs no authorization check, meaning a guest account in an unrelated group can enumerate administrators' operational history including server IPs touched, configs deployed, and services restarted. No patch is available at time of publication; no public exploit code or active exploitation has been identified.

Technical ContextAI

Roxy-WI is a web-based management interface for infrastructure services including HAProxy, Nginx, Apache, and Keepalived, identified by CPE cpe:2.3:a:roxy-wi:roxy-wi:*:*:*:*:*:*:*:*. The vulnerable endpoint GET /history/<service>/<server_ip> is designed for server-scoped history lookups, but when the service parameter equals 'user', the application repurposes the server_ip path segment as a user identifier for database lookup without validating whether the requesting session has rights to view that user's records. This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key) flaw: the application trusts a caller-supplied value to select a sensitive resource without enforcing access control, bypassing the group-based authorization model used elsewhere in the application.

RemediationAI

No vendor-released patch has been identified at time of publication - the CVE description explicitly states no publicly available patches exist, and this is corroborated by the absence of a fix version in the advisory reference. The GitHub Security Advisory at https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9 should be monitored for patch availability. As immediate compensating controls: first, audit and remove unnecessary low-privilege and guest accounts that have no legitimate operational need within the Roxy-WI instance, reducing the authenticated attacker surface. Second, restrict network-level access to the Roxy-WI interface via firewall rules or reverse-proxy ACLs so only trusted management IPs can reach it - this limits who can obtain the required authenticated session. Third, if a WAF or reverse proxy is in front of Roxy-WI, consider blocking or alerting on GET requests matching /history/user/* from non-administrative session tokens. The trade-off of network restriction is reduced accessibility for remote administrators; the trade-off of guest account removal is reduced usability for read-only monitoring users.