CVE-2026-63338: IXP Manager has Broken Object-Level Authorization

Published Oct 30, 2026

Updated

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without checking that userid matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.

Event History

Oct 30, 2026

CVE Published

via MITRE·10:24 PM

Data Sourced

via MITRE·10:24 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated IXP Manager user can exploit it. The vulnerable API-key edit/update path does not verify that the API-key record belongs to the calling user.

What access does an attacker need?

The attacker needs a valid authenticated account and the identifier of another user's API-key record. No user interaction is required.

Which deployments are affected?

IXP Manager versions prior to 7.3.0 are affected. Version 7.3.0 contains the fix.

What can an attacker do through the vulnerable path?

An attacker can view and edit another user's API-key resource through the API-key edit/update path, potentially affecting the confidentiality and integrity of those records.

CVE-2026-63338: IXP Manager has Broken Object-Level Authorization

Event History

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Which deployments are affected?

What can an attacker do through the vulnerable path?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access does an attacker need?

Which deployments are affected?

What can an attacker do through the vulnerable path?