# CVE-2026-45563: Roxy-WI authorization bypass in history endpoint

Source: https://junglewise.ai/threats/cve-2026-45563-roxy-wi-authorization-bypass-in-history-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-45563 · Severity: medium · CVSS 4.3 · Published 2026-06-10

Roxy-WI is a web-based management tool used to configure and control Haproxy, Nginx, Apache, and Keepalived servers. A security flaw allows any logged-in user, including those with restricted guest access, to view the full activity history of any other user on the system. This exposure reveals sensitive operational data, such as which servers were accessed and when configuration changes were made, which could be used to plan more targeted attacks.

Technologies: [Roxy-WI](https://junglewise.ai/threats/technologies/roxy-wi). Vendors: [Roxy-WI](https://junglewise.ai/threats/vendors/roxy-wi).

## Quick answers

**Is CVE-2026-45563 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45563 being exploited in the wild.

**How severe is CVE-2026-45563?** Medium severity, with a CVSS score of 4.3, published 10 June 2026.

**Which products and versions are affected?** Roxy-WI <= 8.2.6.4.

**Is there a fix for CVE-2026-45563?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-45563 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45563?** Check whether you run Roxy-WI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) exists in the `/history/<service>/<server_ip>` endpoint. When the `service` parameter is set to 'user', the application re-uses the `server_ip` path parameter as a `user-id` to fetch audit logs without performing an authorization check or group-access validation. An authenticated attacker (even with guest privileges) can provide an arbitrary user ID to retrieve that user's action history, including server IPs touched, configurations deployed, and services restarted. As of the advisory date, no official patch has been released, though manual code remediation involving `page_for_admin` and `is_user_has_access_to_its_group` checks has been suggested.

## Affected products

- Roxy-WI Roxy-WI <= 8.2.6.4

## Timeline

- 2026-05-15: advisory: GitHub Security Advisory published
- 2026-06-10: disclosed: CVE published to NVD

## References

- [https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9](https://github.com/roxy-wi/roxy-wi/security/advisories/GHSA-wcmc-cjmw-54x9)

## Related threats

- [Roxy-WI path traversal in configuration management](https://junglewise.ai/threats/cve-2026-45569-roxy-wi-path-traversal-in-configuration-management)
- [Roxy-WI authentication bypass via URL substring manipulation](https://junglewise.ai/threats/cve-2026-45567-roxy-wi-authentication-bypass-via-url-substring-manipulation)
- [Roxy-WI open redirect in login flow via userinfo syntax bypass](https://junglewise.ai/threats/cve-2026-45566-roxy-wi-open-redirect-in-login-flow-via-userinfo-syntax-bypass)
- [Roxy-WI input validation bypass in EscapedString validator](https://junglewise.ai/threats/cve-2026-45565-roxy-wi-input-validation-bypass-in-escapedstring-validator)
- [Roxy-WI command injection in config versions save route](https://junglewise.ai/threats/cve-2026-45564-roxy-wi-command-injection-in-config-versions-save-route)