The flaw resides in IXP Manager's API‑key editing workflow. An authenticated user can target any key identifier and the system selects the corresponding record without verifying that the caller’s user_id matches the key’s owner. The attacker thus obtains read/write access to another user's private API key.

This vulnerability affects all IXP Manager releases before version 7.3.0, including the 7.2.x series. The fix was introduced in the 7.3.0 release as a logic check that ties API-key operations to the authenticated user. Administrators using earlier versions leave their users’ credentials exposed if they grant general API‑key management permissions.

The CVSS score of 8.3 classifies the issue as high severity. Because exploitation requires no special privileges beyond valid authentication, the risk is significant for multi‑user deployments. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog, but the publicly disclosed advisory and the nature of the flaw suggest that attackers could readily craft a request to an authorized user session to retrieve or modify another user's key. The primary access vector is a web‑based API request and therefore exploitable over the network.