[ixpmanager] [RELEASE] V7.3.0 - Security Updates (severity: high) , App Passwords feature, API keys modernisation, bug fixes

[Douglas Fischer]

In times like this, container tools (podman or docker) would be greatly
appreciated.

Em seg., 3 de ago. de 2026 às 09:38, Barry O'Donovan (INEX) via ixpmanager <
ixpmanager at inex.ie> escreveu:

>
> Hi all,
>
> Both security issues below have been assigned CVE IDs CVE-2026-63339 and
> CVE-2026-63338, respectively.
>
> The reporter who responsibly disclosed these issues plans to publish more
> details (including the PoC and the root cause) on the oss-security mailing
> list.
>
> We have agreed that they will wait until August 11th, 2026, 12:00 UTC
> before publishing.
>
> If you have not already upgraded your IXP Manager installation to v7.3.1,
> you should do so within the next week.
>
>  - Barry
>
>
>
>
> ------ Original Message ------
> From "Barry O'Donovan (INEX)" <barry.odonovan at inex.ie>
> To "INEX IXP Manager Mailing List" <ixpmanager at inex.ie>
> Date 30/06/2026 19:33:47
> Subject [RELEASE] V7.3.0 - Security Updates (severity: high) , App
> Passwords feature, API keys modernisation, bug fixes
>
>
>
> INEX is pleased to announce the immediate availability of IXP Manager
> v7.3.0. This is primarily a security release following a responsible
> disclosure and subsequent internal hardening. Both issues have a high
> severity. This release also includes some bug fixes, improvements, and new
> features.
>
> ⚠️ All IXP Manager users should upgrade to v7.3.0.
>
>
>
>
> *Our Continuing Security Commitment & EU CRA Alignment*
> As IXP Manager powers critical internet infrastructure globally, security
> is core to our processes, and this is *the fourth successive release* primarily
> focused on security. We have also used third-party reporting as a catalyst
> to perform proactive internal audits of our codebase, leading to the
> discovery and immediate mitigation of additional vulnerabilities.
>
> Also, with the European Union’s Cyber Resilience Act mandatory reporting
> requirements taking effect this September, INEX is cognisant of our legal
> role as an Open-Source Software Steward. To meet these obligations, we have
> reviewed and updated our Security Policy
> <https://github.com/inex/IXP-Manager/security/policy>.
>
>
> *Security Advisory: Vulnerabilities Resolved in v7.3.0*
>
> *Impact:* High (Privilege Escalation & Unauthorised Access)
>
>
>    1. Privilege Escalation (CVE pending) (Severity: 8.8/10) - a confirmed
>    vulnerability allows an authenticated, non-administrative user to elevate
>    their privileges to administrator status. This was responsibly disclosed
>    .
>    2. Broken Object-Level Authorisation (CVE pending) (Severity: 8.3/10)
>    - following the initial report of (1) above, our development team
>    conducted a proactive internal audit. During this review, we identified and
>    corrected an issue in which an authenticated user could view and edit a
>    resource belonging to another user without authorisation.
>
> *Remediation:* Both issues are addressed in this v7.3.0 release. Please
> upgrade to v7.3.0 as soon as possible.
>
>
>
>
> Kind regards,
> Barry O'Donovan
> INEX
>
>
>
>
> _______________________________________________
> INEX IXP Manager mailing list
> ixpmanager at inex.ie
> Unsubscribe or change options here:
> https://www.inex.ie/mailman/listinfo/ixpmanager
>


-- 
Douglas Fernando Fischer
Engº de Controle e Automação
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20260804/10717a10/attachment.htm>