{"affected":[{"product":"IXP-Manager","source":"CNA: GitHub_M","vendor":"inex","versions":[{"status":"affected","version":"< 7.3.0"}]},{"ecosystem":"","packageName":"IXP Manager","product":"IXP Manager","source":"GitHub GHSA-f5xv-q6fj-hfrc","vendor":"","versions":[{"status":"affected","version":"<7.3.0","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-63339","cwes":["CWE-20","CWE-269"],"description":"IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated, non-administrative user can elevate their privileges to administrator status. Restricting administrative functions reduces exposure but is not a complete fix. This issue is fixed in version 7.3.0.","epss":{"date":"2026-11-04","percentile":0.18992,"score":0.00267},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},{"score":8.8,"severity":"high","source":"NVD: security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793847549930,"publishedAt":1793399732619,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/inex/IXP-Manager/releases/tag/v7.3.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/inex/IXP-Manager/releases/tag/v7.3.0"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-f5xv-q6fj-hfrc","text":"IXP Manager: GitHub reports patched versions 7.3.0. Check the advisory for the affected release branch.","url":"https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc"}],"revision":"4825b6c59f95c26349037ca4f44840eebab0aa7cfd00a2bfd459a62bfa8ad8c6","sources":[{"modifiedAt":1793847549930,"name":"CNA: GitHub_M","retrievedAt":1793848280597,"url":"https://www.cve.org/CVERecord?id=CVE-2026-63339"},{"modifiedAt":1793648133347,"name":"NVD","retrievedAt":1793665722587,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63339"},{"modifiedAt":1784228561000,"name":"GitHub Security Advisories","retrievedAt":1793753109789,"url":"https://github.com/inex/IXP-Manager/security/advisories/GHSA-f5xv-q6fj-hfrc"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793848344108,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-63339"}],"ssvc":{"assessedAt":1793847535320,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"IXP Manager has authenticated non-administrator privilege escalation","updatedAt":1793848344108}