Roxy‑WI constructs an LDAP search filter directly from the <username> portion of the request URL using f‑string concatenation. Because no input filtering or LDAP escaping is performed, a specially crafted username such as *)(mail=*)(cn=* can inject additional LDAP clauses. An administrator who accesses the vulnerable endpoint can therefore enumerate or harvest attributes from entries that are not intended to be exposed, leading to confidentiality compromise of potentially sensitive user data.

The vulnerability exists in Roxy‑WI version 8.2.6.4 and all earlier releases. Attackers must possess administrative rights to the web interface to exploit the flaw, as the /user/ldap/<username> endpoint is restricted to admins.

The CVSS score of 4.9 indicates moderate risk, while the EPSS score is not available and KEV does not list the flaw. Exploitation requires access to the administrative interface, so the probability of a successful attack is low unless an attacker has already compromised an admin account or gained delegated access. The worst‑case impact is the disclosure of arbitrary LDAP attributes to the attacker.