CVE-2026-63339

HighCVSS 8.8

Published: 30/10/2026(UTC)Updated: 02/11/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

IXP Manager prior to version 7.3.0 allows an authenticated, non-administrative user to elevate privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. The issue is fixed in version 7.3.0.

Risk Assessment

A regular authenticated user can gain full administrative control over the Internet Exchange Point management application, potentially leading to unauthorized configuration changes and compromise of IXP infrastructure.

Recommendation

Upgrade IXP Manager to version 7.3.0 or later. Until then, limit the number of accounts with access to the application.

Other vulnerabilities in IXP Manager

CVE-2026-63338High
IXP Manager prior to version 7.3.0 allows an authenticated user to view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without verifying that `user_id` matches the caller. The issue is fixed in version 7.3.0.

Original NVD description (English source)

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS