Roxy-WI EUVD-2026-36040

Exploitation requires the attacker to hold a valid Roxy-WI administrator account (CVSS PR:H confirmed from vector AV:N/AC:L/PR:H/UI:N). Additionally, the Roxy-WI deployment must have LDAP authentication configured and integrated with a backend LDAP or Active Directory server - deployments using only local authentication are not affected. The attacker controls the username URL path parameter passed to the get_ldap_email function. Limiting factors include: the requirement for admin-level credentials (PR:H), meaning this is not exploitable by standard authenticated users or unauthenticated actors; and the dependency on LDAP being actively configured, which is a non-default integration step. Scope is limited to confidentiality (S:U, I:N) - no write or availability impact is possible through this vector.

The CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects a meaningful tension between the high confidentiality impact (C:H) and the high privilege requirement (PR:H). An attacker must already hold administrator credentials to Roxy-WI to exploit this, which substantially limits the realistic attack surface - external unauthenticated actors cannot reach this vector. However, within that constrained scenario, the impact is significant: a malicious or compromised admin can exfiltrate LDAP directory data beyond what the application is designed to expose, potentially harvesting email addresses, group memberships, or other attributes across the directory. No EPSS score was provided in the input data, so exploitation probability cannot be quantified from that signal. The CVE is not listed in CISA KEV, and no public exploit code has been identified. This is best characterized as a low-urgency, medium-impact finding for organizations using Roxy-WI with LDAP authentication - real risk is conditional on admin account compromise or insider threat scenarios.

An authenticated Roxy-WI administrator navigates to the user lookup endpoint that triggers get_ldap_email and supplies a crafted username such as *)(mail=*)(cn=* in the URL path parameter. The unsanitized value is interpolated directly into the LDAP search filter, injecting additional clauses that broaden the query scope and return email addresses or other attributes for unintended directory records, effectively allowing the admin to enumerate the connected LDAP directory. No public proof-of-concept code has been identified, but the injection vector is straightforward given the code-level detail disclosed in the advisory.