<html><head>
<style type="text/css"><!--#x3868c6c6a3c540b blockquote.cite2
{margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right: 0px; border-left: 1px solid rgb(204, 204, 204); margin-top: 3px; padding-top: 0px;}
#x3868c6c6a3c540b
{font-family: "Avenir Next"; font-size: 10.5pt;}
--></style><style id="css_styles" type="text/css"><!--blockquote.cite { margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc }
blockquote.cite2 {margin-left: 5px; margin-right: 0px; padding-left: 10px; padding-right:0px; border-left: 1px solid #cccccc; margin-top: 3px; padding-top: 0px; }
a img { border: 0px; }
li[style='text-align: center;'], li[style='text-align: center; '], li[style='text-align: right;'], li[style='text-align: right; '] { list-style-position: inside;}
body { font-family: 'Avenir Next'; font-size: 10.5pt; }
.quote { margin-left: 1em; margin-right: 1em; border-left: 5px #ebebeb solid; padding-left: 0.3em; }
a.em-mention[href] { text-decoration: none; color: inherit; border-radius: 3px; padding-left: 2px; padding-right: 2px; background-color: #e2e2e2; }
._em_placeholder {color: gray; border-bottom: 1px dotted lightblue;} ._em_placeholder:before{color:gray; content: '{{ ';} ._em_placeholder:after{color:gray; content: ' }}';}
--></style>
</head>
<body style="color: rgb(0, 0, 0); overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><br /></div>
<div>Hi all,</div><div><br /></div><div>Both security issues below have been assigned CVE IDs CVE-2026-63339 and CVE-2026-63338, respectively.</div><div><br /></div><div>The reporter who responsibly disclosed these issues plans to publish more details (including the PoC and the root cause) on the oss-security mailing list.</div><div><br /></div><div>We have agreed that they will wait until August 11th, 2026, 12:00 UTC before publishing.</div><div><br /></div><div>If you have not already upgraded your IXP Manager installation to v7.3.1, you should do so within the next week.</div><div><br /></div><div> - Barry</div><div><br /></div><div id="signature_old">
<br />
</div><div><br /></div>
<div x-em-replyforwardheader=""><br /></div>
<div>
<div>------ Original Message ------</div>
<div>From "Barry O'Donovan (INEX)" <<a href="mailto:barry.odonovan@inex.ie">barry.odonovan@inex.ie</a>></div>
<div>To "ixpmanager-announce@inex.ie" <<a href="mailto:ixpmanager-announce@inex.ie">ixpmanager-announce@inex.ie</a>></div>
<div>Date 30/06/2026 19:33:04</div>
<div>Subject [RELEASE] V7.3.0 - Security Updates (severity: high) , App Passwords feature, API keys modernisation, bug fixes[RELEASE] V7.3.0 - Security Updates (severity: high) , App Passwords feature, API keys modernisation, bug fixes</div></div><div x-em-quote=""><br /></div>
<div id="x3868c6c6a3c540b" style="color: rgb(0, 0, 0); overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><blockquote cite="emea5b7bbc-280b-474b-9c95-cf0521f4eed9@inex.ie" type="cite" class="cite2">
<div><div id="x548a0c1e4e73485483f34f3a76019452"><div><br /></div><div><div id="xb88fe02089f2495eae99d1ee657b1103"><div style="margin:0px;"><br /></div><div style="margin:0px;">INEX is pleased to announce the immediate availability of IXP Manager v7.3.0. This is primarily a security release following a responsible disclosure and subsequent internal hardening. Both issues have a high severity. This release also includes some bug fixes, improvements, and new features.</div><div style="margin:0px;"><br /></div><div style="margin:0px;">⚠️ All IXP Manager users should upgrade to v7.3.0.</div><div style="margin:0px;"><br /></div><div style="margin:0px;"><br /></div><div style="margin:0px;"><br /></div><div style="margin:0px;"><u><b>Our Continuing Security Commitment & EU CRA Alignment</b><br /></u><br />As IXP Manager powers critical internet infrastructure globally, security is core to our processes, and this is <i><b>the fourth successive release</b></i> primarily focused on security. We have also used third-party reporting as a catalyst to perform proactive internal audits of our codebase, leading to the discovery and immediate mitigation of additional vulnerabilities.<br /><br />Also, with the European Union’s Cyber Resilience Act mandatory reporting requirements taking effect this September, INEX is cognisant of our legal role as an Open-Source Software Steward. To meet these obligations, we have reviewed and updated our <a href="https://github.com/inex/IXP-Manager/security/policy">Security Policy</a>. <br /></div><div style="margin:0px;"><br /></div><div style="margin:0px;"><br /></div><div style="margin:0px;"><b><u>Security Advisory: Vulnerabilities Resolved in v7.3.0</u></b></div><div style="margin:0px;"><br /></div><div style="margin:0px;"><b>Impact:</b> High (Privilege Escalation & Unauthorised Access)<br /><br /><ol><li>Privilege Escalation (CVE pending) (Severity: 8.8/10) - a confirmed vulnerability allows an authenticated, non-administrative user to elevate their privileges to administrator status. This was responsibly disclosed.</li><li>Broken Object-Level Authorisation (CVE pending) (Severity: 8.3/10) - following the initial report of (1) above, our development team conducted a proactive internal audit. During this review, we identified and corrected an issue in which an authenticated user could view and edit a resource belonging to another user without authorisation.</li></ol><b>Remediation:</b> Both issues are addressed in this v7.3.0 release. Please upgrade to v7.3.0 as soon as possible.<br /></div><div style="margin:0px;"><br /></div><div><br /></div>
<div style="margin:0px;"><br /></div><div id="signature_old" style="clear:both;margin:0px;"><br />
Kind regards,
<br />
Barry O'Donovan
<br />
INEX</div><div id="signature_old" style="clear:both;margin:0px;"></div></div></div><div><br /></div>
<div><br /></div><div id="signature_old">
<br />
</div><div></div></div></div></blockquote></div>
</body></html>