CVE-2026-45559

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.5

Description The get ldap email() function (app/modules/roxywi/user.py:120-157) constructs LDAP search filters using f-string concatenation. Because the username URL path parameter is processed without validation or LDAP escaping, an administrator can inject additional clauses into the filter. This allows for the enumeration or harvesting of attributes beyond the intended record.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.