Roxy-WI: LDAP injection in /user/ldap/<username> (admin-only)
CVE-2026-45559

4.9MEDIUM

Key Information:

Vendor

Roxy-wi

Status
Roxy-wi
Vendor
CVE Published:
10 June 2026

What is CVE-2026-45559?

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, get_ldap_email (app/modules/roxywi/user.py:120-157) builds the LDAP search filter via f-string concatenation. The username URL path parameter is taken verbatim — no checkAjaxInput, no LDAP escape — and inserted, a username like )(mail=)(cn=* injects additional clauses, allowing the admin to enumerate or harvest attributes outside the intended record. At time of publication, there are no publicly available patches.

Affected Version(s)

roxy-wi <= 8.2.6.4

References

https://github.com/roxy-wi/roxy-wi/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.