CVE-2026-51119 - Privilege Escalation in Invixium IXM WEB v2.3.85.25

Overview

A privilege escalation vulnerability exists in Invixium IXM WEB v2.3.85.25 due to missing authorization checks on the POST /SystemUsers/CreateAppUser endpoint.

An authenticated low-privileged user can abuse this endpoint to create a new administrator account, leading to complete administrative access.

• CVE: CVE-2026-51119
• Vendor: Invixium
• Product: IXM WEB
• Affected Version: 2.3.85.25
• Severity: High (Privilege Escalation)

Vulnerability Description

The application exposes the endpoint:

POST /SystemUsers/CreateAppUser

without performing proper server-side authorization checks.

A regular authenticated user can directly invoke this endpoint and create an administrator account even though this functionality should only be available to privileged users.

After creating the administrator account, the attacker can authenticate using the newly created credentials and obtain full administrative privileges.

Impact

Successful exploitation allows an authenticated attacker to:

• Create administrator accounts.
• Escalate privileges.
• Gain full administrative access to the application.
• Manage users and administrative functions.

Attack Requirements

• Valid authenticated user account.
• Network access to the target application.

Root Cause

Improper Authorization (Missing Server-Side Authorization Validation).

The server accepts requests to privileged functionality without verifying whether the authenticated user possesses administrator privileges.

Affected Endpoint

POST /SystemUsers/CreateAppUser

Timeline

Credit

Discovered and responsibly disclosed by Asim.

References

• CVE-2026-51119