Read the docs
TI-2026-83440 Aliases CVE-2026-63339

IXP Manager lets authenticated users escalate to administrator

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.

Summary

IXP Manager before 7.3.0, a web application for managing Internet Exchange Points, has a flaw in privilege management (CWE-269) that lets an authenticated non-administrative user raise their privileges to administrator status. A remote attacker with a low-privileged account needs no user interaction to do this. Successful exploitation can fully compromise confidentiality, integrity and availability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix Fixed IXP-Manager (inex): 7.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
inexIXP-Managerbefore 7.3.07.3.0Patch availableCNA
  • IXP-Manager Vendorinex Affected before 7.3.0 Fixed in 7.3.0 Patch available CNA

Remediation

Upgrade IXP Manager to version 7.3.0, which fixes this issue. Restricting administrative functions reduces exposure but is not a complete fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

  • Fix · CNA IXP-Manager (inex) Fixed in 7.3.0

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-63339
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-05 CISA SSVC decision points changed
  4. 2026-11-05 Priority changed: LOW → MEDIUM

References

Other 2

  • TI-2026-83438 Broken authorization in IXP Manager exposes other users' API keys CVSS 3.1HIGH 8.3
  • TI-2022-04163 INEX IPX-Manager list.foil.php cross site scripting CVSS 3.1MEDIUM 6.1
  • TI-2023-18482 INEX IXP-Manager before 6.3.1 allows XSS. CVSS 3.1MEDIUM 6.1
  • TI-2020-15216 Cross Site Scripting vulnerabilty found in IXPManager v.5.6.0 allows attackers to excute… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences