EUVD-2026-42961
GHSA-g6v8-8hw9-mxr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach IXM WEB console over network
-
DeliverySend crafted request to /SystemUsers/CreateAppUser
-
ExploitBypass privilege checks (CWE-269)
-
ExecutionCreate or elevate application account
-
ImpactGain administrative control of access-control platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the specific /SystemUsers/CreateAppUser application-user creation component of Invixium IXM WEB 2.3.85.25 and requires network reachability to that web console. Per the NVD CVSS vector (AV:N/AC:L/PR:N/UI:N) it needs no user interaction and no authentication and works against the affected version's default handling, giving high confidentiality and integrity impact but no availability impact (A:N). Limiting factor: the term 'escalate privileges' implies the attacker may need an initial low-privileged foothold or session, which conflicts with the vector's PR:N - this should be confirmed with the vendor. Practical exposure is further limited to deployments where the IXM WEB management interface is network-accessible to the attacker (e.g. not segmented onto an isolated management network). |
| Impact | Signals are mixed. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:N = 9.1) portrays a network-reachable, low-complexity, no-authentication, no-user-interaction attack with high confidentiality and integrity impact - a critical rating. SSVC reinforces severity on impact (Technical Impact: total, Automatable: yes) but scores Exploitation as 'none', i.e. no observed exploitation. EPSS is low (0.38%), and the CVE is not in CISA KEV, so real-world exploitation appears targeted or theoretical rather than mass-automated at this time. A notable conflict: the description frames this as 'escalate privileges,' which normally presupposes some existing foothold, yet the CVSS vector claims PR:N (fully unauthenticated) - verify with the vendor whether CreateAppUser is reachable pre-authentication or requires a low-privileged session. A public PoC does exist, which raises practical risk above the low EPSS number, but PoC availability is not the same as active exploitation. |
| Exploit ScenarioDerived | An attacker who can reach the IXM WEB interface over the network sends a crafted request to /SystemUsers/CreateAppUser to create or elevate an application account, yielding administrative control over the biometric access-control system. A public proof-of-concept is published on GitHub (A17-ba/CVE-2026-51119), lowering the skill required; the low attack complexity (AC:L) means no special timing or race conditions are needed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation in Invixium IXM WEB v2.3.85.25 lets remote attackers abuse the /SystemUsers/CreateAppUser endpoint to provision unauthorized application accounts and gain elevated access to the biometric access-control management platform. Publicly available exploit code exists (GitHub PoC), though there is no public exploit identified as actively used in the wild and the issue is not in CISA KEV. EPSS is low (0.38%, 30th percentile), suggesting no widespread automated exploitation to date despite the high 9.1 CVSS score.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so a specific upgrade target cannot be cited; monitor Invixium (https://invixium.com) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51119) for an advisory and patched build, and contact Invixium support directly referencing CVE-2026-51119 / EUVD-2026-42961. As compensating controls, restrict network access to the IXM WEB console so the /SystemUsers/CreateAppUser endpoint is reachable only from a trusted management VLAN or via VPN (trade-off: legitimate remote administration must move behind that boundary); place the console behind a reverse proxy or WAF rule that blocks or requires authentication on /SystemUsers/CreateAppUser (trade-off: may break legitimate provisioning workflows that use that path); and audit existing application/system user accounts for unexpected or over-privileged entries and enable logging/alerting on account-creation events to detect abuse. Because a public PoC exists, treat exposure of this interface to untrusted networks as urgent.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
IXM WEB is Invixium's web-based management console for its IXM line of biometric (fingerprint/face) access-control terminals, used to administer devices, users, and enrollment data. The flaw is classified CWE-269 (Improper Privilege Management): the /SystemUsers/CreateAppUser component - an application-user creation function - does not correctly enforce authorization boundaries, allowing an actor to create or assign accounts with privileges they should not receive. Because this is an account-provisioning function within the identity/administration layer of a physical access-control product, weaknesses here directly translate into administrative control over who can manage doors, readers, and enrolled identities. CPE data is uninformative here (the published CPE is the placeholder 'cpe:2.3:a:n/a:n/a'), so the affected product must be identified from the description and vendor references rather than from structured NVD product data.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable, low-complexity endpoint; 'escalate privileges' implies an existing low-privileged foothold (PR:L rather than PR:N), yielding high confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components
Executive ViewAI
Invixium IXM WEB v2.3.85.25 contains a critical privilege escalation vulnerability allowing remote attackers to provision unauthorized administrative accounts and gain elevated access to the biometric access-control management platform. Public exploit code is available on GitHub, and with no vendor patch currently available, organizations using this version remain exposed to account compromise and unauthorized system access.
No vendor-released patch identified at time of analysis. Implement network segmentation to restrict API access to trusted administrative networks; disable the /SystemUsers/CreateAppUser endpoint if not actively used; enable comprehensive audit logging for all user provisioning activities; deploy real-time monitoring for unauthorized account creation; and consider implementing additional authentication controls (such as IP whitelisting or API key rotation) at network boundaries.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB