---
id: CVE-2026-63338
title: IXP Manager has Broken Object-Level Authorization
summary: >-
  IXP Manager is a full-stack web application for managing Internet Exchange
  Points. Prior to version 7.3.0, an authenticated user can view and edit a
  resource belonging to another user without authorization. The API-key
  edit/update path i…
severity: high
cvss: 8.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-863
  - CWE-639
vendor: inex
product: IXP-Manager
affected:
  - IXP-Manager < 7.3.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T22:24:52.299Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63338'
references:
  - url: >-
      https://github.com/inex/IXP-Manager/security/advisories/GHSA-m7g4-g69h-vj5w
    label: >-
      https://github.com/inex/IXP-Manager/security/advisories/GHSA-m7g4-g69h-vj5w
  - url: >-
      https://github.com/inex/IXP-Manager/commit/3856e93681cc5efdaf9e3a7f53a751081433d021
    label: >-
      https://github.com/inex/IXP-Manager/commit/3856e93681cc5efdaf9e3a7f53a751081433d021
  - url: 'https://github.com/inex/IXP-Manager/releases/tag/v7.3.0'
    label: 'https://github.com/inex/IXP-Manager/releases/tag/v7.3.0'
tags:
  - cve.org
epss: 0.0026
epssPercentile: 0.17816
ingestedAt: '2026-11-05T16:24:31.485Z'
---

## Overview

IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` selects records by identifier without checking that `user_id` matches the caller, allowing access to another user's API-key record. This issue is fixed in version 7.3.0.

## Affected

- `IXP-Manager < 7.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.