EUVD-2026-42961
GHSA-g6v8-8hw9-mxr9
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable, low-complexity endpoint; 'escalate privileges' implies an existing low-privileged foothold (PR:L rather than PR:N), yielding high confidentiality/integrity impact and no availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components
AnalysisAI
Privilege escalation in Invixium IXM WEB v2.3.85.25 lets remote attackers abuse the /SystemUsers/CreateAppUser endpoint to provision unauthorized application accounts and gain elevated access to the biometric access-control management platform. Publicly available exploit code exists (GitHub PoC), though there is no public exploit identified as actively used in the wild and the issue is not in CISA KEV. EPSS is low (0.38%, 30th percentile), suggesting no widespread automated exploitation to date despite the high 9.1 CVSS score.
Technical ContextAI
IXM WEB is Invixium's web-based management console for its IXM line of biometric (fingerprint/face) access-control terminals, used to administer devices, users, and enrollment data. The flaw is classified CWE-269 (Improper Privilege Management): the /SystemUsers/CreateAppUser component - an application-user creation function - does not correctly enforce authorization boundaries, allowing an actor to create or assign accounts with privileges they should not receive. Because this is an account-provisioning function within the identity/administration layer of a physical access-control product, weaknesses here directly translate into administrative control over who can manage doors, readers, and enrolled identities. CPE data is uninformative here (the published CPE is the placeholder 'cpe:2.3:a:n/a:n/a'), so the affected product must be identified from the description and vendor references rather than from structured NVD product data.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so a specific upgrade target cannot be cited; monitor Invixium (https://invixium.com) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-51119) for an advisory and patched build, and contact Invixium support directly referencing CVE-2026-51119 / EUVD-2026-42961. As compensating controls, restrict network access to the IXM WEB console so the /SystemUsers/CreateAppUser endpoint is reachable only from a trusted management VLAN or via VPN (trade-off: legitimate remote administration must move behind that boundary); place the console behind a reverse proxy or WAF rule that blocks or requires authentication on /SystemUsers/CreateAppUser (trade-off: may break legitimate provisioning workflows that use that path); and audit existing application/system user accounts for unexpected or over-privileged entries and enable logging/alerting on account-creation events to detect abuse. Because a public PoC exists, treat exposure of this interface to untrusted networks as urgent.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today