Is CVE-2026-45563 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45563 being exploited in the wild.

How severe is CVE-2026-45563?

Medium severity, with a CVSS score of 4.3, published 10 June 2026.

Is there a fix for CVE-2026-45563?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-45563 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45563?

Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45563: Roxy-WI authorization bypass in history endpoint

CVE-2026-45563 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Roxy-WI is a web-based management tool used to configure and control Haproxy, Nginx, Apache, and Keepalived servers. A security flaw allows any logged-in user, including those with restricted guest access, to view the full activity history of any other user on the system. This exposure reveals sensitive operational data, such as which servers were accessed and when configuration changes were made, which could be used to plan more targeted attacks.

Technologies: Roxy-WI. Vendors: Roxy-WI.

Quick answers

Is CVE-2026-45563 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45563 being exploited in the wild.
How severe is CVE-2026-45563?: Medium severity, with a CVSS score of 4.3, published 10 June 2026.
Which products and versions are affected?: Roxy-WI <= 8.2.6.4.
Is there a fix for CVE-2026-45563?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-45563 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45563?: Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) exists in the `/history/<service>/<server_ip>` endpoint. When the `service` parameter is set to 'user', the application re-uses the `server_ip` path parameter as a `user-id` to fetch audit logs without performing an authorization check or group-access validation. An authenticated attacker (even with guest privileges) can provide an arbitrary user ID to retrieve that user's action history, including server IPs touched, configurations deployed, and services restarted. As of the advisory date, no official patch has been released, though manual code remediation involving `page_for_admin` and `is_user_has_access_to_its_group` checks has been suggested.

Affected products

Roxy-WI Roxy-WI <= 8.2.6.4

Timeline

2026-05-15: advisory: GitHub Security Advisory published
2026-06-10: disclosed: CVE published to NVD

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.