The vulnerability is an IDOR that allows any authenticated user—including users in unrelated groups—to read the full action history of any other user. By re‑using the server_ip path parameter as a user‑id when the service is "user", the application performs no authorization check. Attackers can therefore obtain detailed audit data such as which server IPs a victim accessed, which configurations were deployed, and which services were restarted, providing insight into operational details.

All releases of Roxy‑WI up to and including 8.2.6.4, which provide a web interface for managing HAProxy, Nginx, Apache and Keepalived servers, are affected.

The vulnerability has a CVSS score of 4.3, indicating moderate severity. No EPSS score is available and the issue is not listed in the CISA KEV catalog, suggesting limited or no widespread exploitation yet. Attackers must first authenticate to Roxy‑WI and call the vulnerable GET /history/<service>/<server_ip> endpoint. Without a required authorization check, they can supply another user’s in the URL and obtain that user’s full audit trail. Successful exploitation compromises confidentiality, revealing sensitive deployment and configuration history that could aid future attacks.