[ixpmanager] [RELEASE] V7.3.0 - Security Updates (severity: high) , App Passwords feature, API keys modernisation, bug fixes

[Barry O'Donovan (INEX)]

Hi all,

Both security issues below have been assigned CVE IDs CVE-2026-63339 and 
CVE-2026-63338, respectively.

The reporter who responsibly disclosed these issues plans to publish 
more details (including the PoC and the root cause) on the oss-security 
mailing list.

We have agreed that they will wait until August 11th, 2026, 12:00 UTC 
before publishing.

If you have not already upgraded your IXP Manager installation to 
v7.3.1, you should do so within the next week.

  - Barry




------ Original Message ------
>From "Barry O'Donovan (INEX)" <barry.odonovan at inex.ie>
To "INEX IXP Manager Mailing List" <ixpmanager at inex.ie>
Date 30/06/2026 19:33:47
Subject [RELEASE] V7.3.0 - Security Updates (severity: high) , App 
Passwords feature, API keys modernisation, bug fixes

>
>
>INEX is pleased to announce the immediate availability of IXP Manager 
>v7.3.0. This is primarily a security release following a responsible 
>disclosure and subsequent internal hardening. Both issues have a high 
>severity. This release also includes some bug fixes, improvements, and 
>new features.
>
>⚠️ All IXP Manager users should upgrade to v7.3.0.
>
>
>
>Our Continuing Security Commitment & EU CRA Alignment
>
>As IXP Manager powers critical internet infrastructure globally, 
>security is core to our processes, and this is the fourth successive 
>release primarily focused on security. We have also used third-party 
>reporting as a catalyst to perform proactive internal audits of our 
>codebase, leading to the discovery and immediate mitigation of 
>additional vulnerabilities.
>
>Also, with the European Union’s Cyber Resilience Act mandatory 
>reporting requirements taking effect this September, INEX is cognisant 
>of our legal role as an Open-Source Software Steward. To meet these 
>obligations, we have reviewed and updated our Security Policy 
><https://github.com/inex/IXP-Manager/security/policy>.
>
>
>Security Advisory: Vulnerabilities Resolved in v7.3.0
>
>Impact: High (Privilege Escalation & Unauthorised Access)
>
>Privilege Escalation (CVE pending) (Severity: 8.8/10) - a confirmed 
>vulnerability allows an authenticated, non-administrative user to 
>elevate their privileges to administrator status. This was responsibly 
>disclosed.
>Broken Object-Level Authorisation (CVE pending) (Severity: 8.3/10) - 
>following the initial report of (1) above, our development team 
>conducted a proactive internal audit. During this review, we identified 
>and corrected an issue in which an authenticated user could view and 
>edit a resource belonging to another user without authorisation.
>Remediation: Both issues are addressed in this v7.3.0 release. Please 
>upgrade to v7.3.0 as soon as possible.
>
>
>
>
>Kind regards,
>Barry O'Donovan
>INEX
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20260803/a81faeb9/attachment.htm>