Roxy-WI EUVD-2026-36043

Exploitation requires a valid authenticated Roxy-WI session with at minimum a guest-level account, as confirmed by CVSS PR:L - unauthenticated attackers cannot reach this endpoint. The specific vulnerable code path is only triggered when the service path parameter is explicitly set to 'user'; other service values (e.g., haproxy, nginx, apache, keepalived) are not described as subject to this same authorization bypass. The attacker must supply a valid user identifier in the server_ip path position, which may require prior enumeration of user IDs or IP-based identifiers used internally. Exploitation is limited by the authentication prerequisite and by the scope of exposed data being audit trail records rather than credentials or raw configuration files. Deployments where all authenticated users are equally trusted (e.g., single-team internal tools) face lower practical risk than those with mixed-trust user populations such as MSPs or multi-tenant environments.

The CVSS 4.3 Medium score is internally consistent with the impact: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N indicates a network-reachable flaw requiring only a low-privilege account, with no interaction needed and limited confidentiality impact. The PR:L requirement is the primary risk reducer - unauthenticated attackers cannot exploit this directly. EPSS data was not provided in the intelligence input and cannot be inferred. There is no CISA KEV listing and no public exploit code identified at time of analysis, placing this in a low-urgency exploitation posture. However, the absence of a patch meaningfully elevates risk for affected deployments: until remediation is available, every authenticated session - including guests - represents a potential data exposure vector. The leaked audit data (server IPs, config deployments, restart operations) has real operational security value for an attacker performing infrastructure reconnaissance. This is a genuine confidentiality risk in environments with mixed-trust users rather than a theoretical edge case.

An attacker with any valid Roxy-WI account - including a guest account provisioned for a different server group - sends a GET request to /history/user/<target_user_id> with a known or enumerated administrator user identifier in the path. The application performs no group membership or ownership check and returns the administrator's complete audit trail, revealing which server IPs were recently accessed, what configurations were pushed, and which services were restarted. This operational data allows the attacker to map the managed infrastructure and identify high-value targets without triggering any access control alert. No public exploit code has been identified at time of analysis.