Live › vulnerability › CVE-2026-63338
IXP Manager, a web application for running Internet Exchange Points, lets a logged-in user view and edit API-key records that belong to other users. An attacker with any account could read or change another user's API key and act through it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 23:26 UTC. All times on this page are UTC.
Teams running IXP Manager versions before 7.3.0 where users have accounts on the web interface. Exposure depends on users with valid logins being able to reach the API-key edit function. Instances that are not run by a multi-user team, or that are already on 7.3.0 or later, are not affected.
No product ranges from the sources yet.
7.3.0.ApiKeyController update path that selects API keys by id without a user_id check.7.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in ApiKeyController selects records by identifier without checking that user_id matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-63338")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.