CVE-2026-51119 Overview
CVE-2026-51119 is a privilege escalation vulnerability affecting Invixium IXM WEB version 2.3.85.25. The flaw resides in the /SystemUsers/CreateAppUser component and allows a remote attacker to elevate privileges without authentication. The vulnerability is categorized under [CWE-269] Improper Privilege Management. Invixium IXM WEB is the management platform used to administer Invixium biometric access control devices, making this component a high-value target for attackers seeking control over physical access systems.
Critical Impact
An unauthenticated network attacker can create application user accounts with elevated privileges, gaining administrative control over the IXM WEB management platform and connected biometric access devices.
Affected Products
- Invixium IXM WEB version 2.3.85.25
- Deployments exposing the /SystemUsers/CreateAppUser endpoint to untrusted networks
- Environments integrating IXM WEB with Invixium biometric access control hardware
Discovery Timeline
- 2026-07-10 - CVE-2026-51119 published to the National Vulnerability Database
- 2026-07-10 - Last updated in NVD database
Technical Details for CVE-2026-51119
Vulnerability Analysis
The vulnerability exists in the /SystemUsers/CreateAppUser component of Invixium IXM WEB v2.3.85.25. This endpoint handles the creation of application users within the management console. Improper privilege management on this route allows an attacker to invoke user-creation functionality that should be restricted to administrative roles. The flaw is exploitable over the network with low attack complexity and does not require prior authentication or user interaction.
Successful exploitation yields elevated privileges within the IXM WEB application. An attacker can then modify system configurations, manage biometric enrollment data, and control access decisions made by connected Invixium hardware. Additional technical context is available in the GitHub CVE-2026-51119 Repository.
Root Cause
The root cause is improper enforcement of authorization on the CreateAppUser action within the SystemUsers controller. The endpoint fails to validate that the requester holds the required administrative role before executing user creation logic. This class of defect maps to [CWE-269] Improper Privilege Management.
Attack Vector
Exploitation occurs over the network by issuing a crafted HTTP request to the /SystemUsers/CreateAppUser endpoint of an exposed IXM WEB instance. The attacker submits parameters that provision a new application user with elevated rights. The action requires no valid session token and no interaction from a legitimate operator.
No verified proof-of-concept code is published in NVD. Refer to the GitHub CVE-2026-51119 Repository for community-contributed technical details.
Detection Methods for CVE-2026-51119
Indicators of Compromise
- Unexpected application user accounts appearing in the IXM WEB SystemUsers table.
- HTTP requests to /SystemUsers/CreateAppUser originating from external or unmanaged source IP addresses.
- Audit log entries showing user creation actions without a corresponding authenticated administrator session.
- New administrative logins from unfamiliar workstations shortly after account creation events.
Detection Strategies
- Inspect web server access logs for POST requests targeting /SystemUsers/CreateAppUser and correlate them with authenticated session identifiers.
- Compare the current application user roster against a known-good baseline and alert on additions.
- Monitor for anomalous role assignments or privilege changes within IXM WEB application logs.
Monitoring Recommendations
- Forward IXM WEB web and application logs to a centralized log platform for retention and correlation.
- Alert on any privileged account creation outside a documented change window.
- Track outbound access from IXM WEB hosts to detect follow-on activity such as data exfiltration or device tampering.
How to Mitigate CVE-2026-51119
Immediate Actions Required
- Restrict network access to IXM WEB management interfaces to trusted administrative networks and VPN segments.
- Audit the SystemUsers table and remove any application user accounts that cannot be attributed to authorized administrators.
- Rotate credentials for all remaining IXM WEB accounts and enforce strong password policies.
- Contact Invixium through the Invixium Official Site to obtain patch availability and vendor guidance.
Patch Information
No fixed version is published in the NVD advisory at the time of writing. Administrators should consult Invixium Security Information for the latest updates and apply any released patch to versions above 2.3.85.25 as soon as it becomes available.
Workarounds
- Place IXM WEB behind a reverse proxy that enforces authentication before requests reach the application.
- Block external access to the /SystemUsers/* URL path at the network perimeter or web application firewall.
- Implement IP allowlisting on the web server so only administrative workstations can reach management endpoints.
- Increase audit log retention and enable alerting on user-management operations until a vendor patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
