{"id":"CVE-2026-63339","aliases":[],"cve":{"records":[{"id":"CVE-2026-63339","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-16T14:14:24.385Z","published":"2026-10-30T22:35:32.619Z","modified":"2026-10-30T22:35:32.619Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:35:32.619Z"}],"references":[{"url":"https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/inex/IXP-Manager/releases/tag/v7.3.0","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-20","description":"CWE-20: Improper Input Validation","source":"GitHub_M"},{"id":"CWE-269","description":"CWE-269: Improper Privilege Management","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"IXP Manager has authenticated non-administrator privilege escalation","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.","score":8.8,"severity":"high","published":"2026-10-30T22:35:32.619Z","modified":"2026-10-30T22:35:32.619Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"inex","name":"IXP-Manager","platforms":[],"versions":[{"version":"< 7.3.0","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-63339"}],"remediation":[],"references":["https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc","https://github.com/inex/IXP-Manager/releases/tag/v7.3.0"],"sources":[{"name":"CVE","id":"CVE-2026-63339","modified":"2026-10-30T22:35:32.619Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63339"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-30T22:47:28.164Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-10-30T22:50:33.924Z","attemptedAt":"2026-10-30T22:50:33.924Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T22:50:34.357Z","attemptedAt":"2026-10-30T22:50:34.357Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T22:50:34.894Z","attemptedAt":"2026-10-30T22:50:34.894Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T22:50:34.095Z","attemptedAt":"2026-10-30T22:50:34.095Z"}],"evidence":[],"aiSummary":{"text":"IXP Manager, a web application for managing Internet Exchange Points, has a vulnerability where an authenticated non-admin user can escalate privileges to administrator before version 7.3.0. The issue is related to improper input validation and privilege management. It is fixed in version 7.3.0.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:11:06.413Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-63339"}]}}