Executive Summary

CVE-2026-45563 is an Insecure Direct Object Reference (IDOR) vulnerability in Roxy-WI versions 8.2.6.4 and earlier. It occurs in the /history/<service>/<server_ip> endpoint, where the server_ip parameter is incorrectly treated as a user ID when the service parameter is set to 'user'. This happens without proper authorization checks.

As a result, any authenticated user, including guests from unrelated groups, can access the full action audit trail of any other user. This audit trail includes sensitive information such as server IPs accessed, configuration changes deployed, and services restarted.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthorized users to view sensitive audit logs of other users, which can reveal detailed information about server interactions, configuration deployments, and service restarts.

Such exposure can aid attackers in reconnaissance efforts, potentially enabling targeted attacks against the infrastructure managed by Roxy-WI.

Although the CVSS score is moderate (4.3), the unauthorized disclosure of audit trails can compromise operational security and privacy.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the Roxy-WI instance is running a vulnerable version (8.2.6.4 or earlier) and by testing access to the endpoint `/history/<service>/<server_ip>` with the `service` parameter set to 'user'. If an authenticated user can retrieve another user's full action history without proper authorization, the vulnerability is present.

A possible command to test this could be using curl to send a GET request to the endpoint with a valid authenticated session cookie or token, for example:

• curl -i -H "Cookie: session=<valid_session_cookie>" "https://<roxy-wi-server>/history/user/<another_user_ip>"

If the response contains audit logs or action history of another user, it confirms the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

Since no patches are currently available for this vulnerability, immediate mitigation steps include:

• Restrict access to the Roxy-WI web interface to trusted users only.
• Limit authenticated user permissions and avoid granting unnecessary access to guest or unrelated groups.
• Monitor and audit access logs for suspicious activity related to the `/history/user/` endpoint.
• Consider implementing network-level controls such as firewall rules to restrict access to the Roxy-WI server.
• Avoid sharing session tokens or credentials that could be used to exploit this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows any authenticated user to access another user's full action audit trail without proper authorization. Such unauthorized access to sensitive audit logs, including server interactions and configuration changes, can lead to exposure of personal or sensitive information.

This unauthorized disclosure of user activity data may violate compliance requirements under standards like GDPR and HIPAA, which mandate strict controls over access to personal and sensitive information and require audit logs to be protected against unauthorized access.

Useful 0 Not Useful 0