{"id":"CVE-2026-63338","kind":"vulnerability","aliases":["CVE-2026-63338"],"related":[],"title":"IXP Manager: users can edit other users' API keys","description":"IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.","summary":"IXP Manager, a web application for running Internet Exchange Points, lets a logged-in user view and edit API-key records that belong to other users. An attacker with any account could read or change another user's API key and act through it.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["internet-exchange-operators","ixp-manager","package","self-hosted"],"not_affected_if":["single-user-instance","version-7.3.0-or-later"],"how_to_check":"- Check the installed IXP Manager version and compare it with `7.3.0`.\n- Look at the IXP Manager install for the `ApiKeyController` update path that selects API keys by id without a `user_id` check.","fix":"- Upgrade IXP Manager to `7.3.0` or later.","status":"open","published_at":"2026-10-30T23:17:13+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","triaged_at":"2026-10-30T23:28:06+00:00","updated_at":"2026-10-30T23:28:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T23:28:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IXP Manager to `7.3.0` or later.","reach":"internet","title":"IXP Manager: users can edit other users' API keys","impact":"medium","summary":"IXP Manager, a web application for running Internet Exchange Points, lets a logged-in user view and edit API-key records that belong to other users. An attacker with any account could read or change another user's API key and act through it.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ixp-manager","internet-exchange-operators","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Another user's API key can be read and changed by an authenticated user.","analyst_note":"","how_to_check":"- Check the installed IXP Manager version and compare it with `7.3.0`.\n- Look at the IXP Manager install for the `ApiKeyController` update path that selects API keys by id without a `user_id` check.","plain_action":"","needs_analyst":false,"not_affected_if":["version-7.3.0-or-later","single-user-instance"],"who_is_affected":"Teams running IXP Manager versions before 7.3.0 where users have accounts on the web interface. Exposure depends on users with valid logins being able to reach the API-key edit function. Instances that are not run by a multi-user team, or that are already on 7.3.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4147,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-63338':12A,15A '7.3.0':88C,140C 'access':125C 'account':59B 'act':70B 'allow':124C 'anoth':64B,100C,127C 'api':8A,47B,67B,106C,131C 'api-key':46B,105C,130C 'apikeycontrol':111C 'applic':31B,79C 'attack':56B 'authent':90C 'author':103C 'belong':51B,98C 'caller':123C 'chang':63B 'check':117C 'could':60B 'cve':10A,13A 'edit':5A,45B,95C 'edit/update':108C 'exchang':18B,35B,83C 'fix':137C 'full':76C 'full-stack':75C 'host':26B 'id':120C 'identifi':115C 'internet':17B,34B,82C 'internet-exchange-oper':16B 'issu':135C 'ixp':1A,21B,27B,71C 'ixp-manag':20B 'key':9A,48B,68B,107C,132C 'let':37B 'log':40B 'logged-in':39B 'manag':2A,22B,28B,72C,81C 'match':121C 'oper':19B 'packag':23B 'path':109C 'point':36B,84C 'prior':85C 'read':61B 'record':49B,113C,133C 'resourc':97C 'run':33B 'select':112C 'self':25B 'self-host':24B 'stack':77C 'user':3A,7A,42B,54B,65B,91C,101C,119C,128C 'version':87C,139C 'view':43B,93C 'web':30B,78C 'without':102C,116C","nicknames":[],"mitigations":[],"who_affected":"Teams running IXP Manager versions before 7.3.0 where users have accounts on the web interface. Exposure depends on users with valid logins being able to reach the API-key edit function. Instances that are not run by a multi-user team, or that are already on 7.3.0 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T23:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63338","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63338","severity":null,"published_at":"2026-10-30T23:17:13+00:00","modified_at":"2026-10-30T23:17:13+00:00","first_seen_at":"2026-10-30T23:26:12+00:00","fetched_at":"2026-10-30T23:26:12+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}