CVE-2026-63338

Received Received - Intake

Authenticated API Key Access in IXP Manager

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63338

Affected Vendors & Products

Vendor	Product	Version / Range
inex	IXP-Manager	< 7.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in IXP Manager allows an authenticated user to view and edit another user's resources without proper authorization. Specifically, the API-key edit/update path in ApiKeyController does not verify that the user_id matches the caller, enabling unauthorized access to another user's API-key record.

Impact Analysis

An attacker with valid credentials could access or modify another user's API keys, potentially leading to unauthorized actions, data breaches, or further system compromise. This could disrupt IXP operations or expose sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to user data, potentially breaching GDPR (data protection) or HIPAA (health information privacy) regulations. Organizations using affected versions may face legal and regulatory penalties.

Mitigation Strategies

Upgrade IXP Manager to version 7.3.0 or later to address the authorization bypass in ApiKeyController. Ensure all authenticated users are verified for proper access controls.

Hi! I’m here to help you understand CVE-2026-63338. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70