Description
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).
Published: 2026-08-17
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in phpIPAM v1.8.1 and earlier, where the application fails to validate that an IP address requested via a temporary share URL belongs to the subnet for which that share was issued. As a result, an unauthenticated attacker who knows a valid, non‑expired temporary share link can iterate the subnetId parameter and retrieve full address records of any subnet in the system. Disclosed data includes host names, DNS entries, MAC addresses, owner or contact fields, and notes that may contain sensitive credentials or configuration information.

Affected Systems

phpIPAM, supplied by phpipam:phpipam, versions up to and including 1.8.1, specifically the app/temp_share/index.php and app/temp_share/address.php modules. A security update in release v1.8.2 introduces the missing validation.

Risk and Exploitability

The flaw is assigned a CVSS score of 8.7, signifying high severity. The exploit requires only possession of a temporary share URL with no authentication, making it easily exploitable in environments that expose these links. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the nature of the data exposed and the simplicity of the attack vector elevate the risk. Once the vendor patch is applied, the vulnerability is effectively mitigated.

Generated by OpenCVE AI on August 17, 2026 at 21:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update phpIPAM to version 1.8.2 or later to apply the official fix for subnet membership validation.
  • Disable or limit the use of temporary subnet share URLs until the patch is deployed, ensuring that only authorized personnel can generate such links.
  • Review stored notes and configuration fields to confirm that sensitive credentials are not stored in publicly accessible address records and apply least‑privilege controls on data exposure.

Generated by OpenCVE AI on August 17, 2026 at 21:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 17 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).
Title phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter
First Time appeared Phpipam
Phpipam phpipam
Weaknesses CWE-639
CPEs cpe:2.3:a:phpipam:phpipam:*:*:*:*:*:*:*:*
Vendors & Products Phpipam
Phpipam phpipam
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Phpipam Phpipam
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-17T20:36:01.403Z

Reserved: 2026-08-17T17:28:41.677Z

Link: CVE-2026-75105

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-17T21:16:49.473

Modified: 2026-08-17T21:16:49.473

Link: CVE-2026-75105

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T22:00:03Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key