CVE-2026-75105

Received Received - Intake

phpIPAM Subnet ID Authorization Bypass Exposes IP Data

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulnCheck

Description

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-17

Last Modified

2026-08-17

Generated

2026-08-18

AI Q&A

2026-08-18

EPSS Evaluated

N/A

NVD

CVE-2026-75105

EUVD

EUVD-2026-60385

Affected Vendors & Products

Vendor	Product	Version / Range
phpipam	phpipam	1.8.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

phpIPAM through version 1.8.1 has a flaw where temporary share tokens do not verify if an IP address belongs to the authorized subnet. When a share type is set to 'subnets', the subnetId parameter is used directly to fetch IP addresses without confirming subnet ownership. This allows unauthenticated users with a valid share URL to enumerate and access all IP address records across sections, including sensitive details like hostnames, DNS names, MAC addresses, and notes that may contain credentials.

Impact Analysis

This vulnerability allows unauthorized access to sensitive network information. Attackers can retrieve IP addresses, hostnames, MAC addresses, and potentially credentials or configuration details stored in notes. This could lead to further attacks like lateral movement within a network, privilege escalation, or exposure of confidential data.

Mitigation Strategies

Upgrade phpIPAM to the latest version beyond 1.8.1 to address the improper subnet verification in temporary share tokens. Review and restrict access to sensitive IP address records, especially those containing credentials or configuration details. Monitor for unauthorized enumeration attempts of subnetId parameters.

Hi! I’m here to help you understand CVE-2026-75105. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70