CVE-2026-45563

Name of the Vulnerable Software and Affected Versions Roxy-WI versions prior to 8.2.6.4

Description An authorization bypass exists in the web interface when the service parameter is set to 'user'. The application re-uses the server ip path parameter as a user-id in the 'GET /history//' endpoint without verifying permissions. This allows any authenticated user, including guests, to access the full action audit trail of any other user, revealing details such as touched server IPs, deployed configurations, and restarted services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.