CVE-2026-63338

HighCVSS 8.3

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

IXP Manager prior to version 7.3.0 allows an authenticated user to view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without verifying that `user_id` matches the caller. The issue is fixed in version 7.3.0.

Risk Assessment

A user can access other users' API keys, enabling impersonation and performing operations on their behalf. This can lead to confidentiality and integrity breaches in the IXP system.

Recommendation

Upgrade IXP Manager to version 7.3.0 or later. Consider rotating API keys after applying the fix.

Other vulnerabilities in IXP Manager

CVE-2026-63339High
IXP Manager prior to version 7.3.0 allows an authenticated, non-administrative user to elevate privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. The issue is fixed in version 7.3.0.

Original NVD description (English source)

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS