The flaw is in phpIPAM's User API controller, where requests using the id values "admins" or "all" bypass the intended authorization checks. An attacker who can invoke these API endpoints can gain access to resources or actions that should be reserved for legitimate administrators, effectively providing full control over the IP address management system and its underlying data. This offers a privilege escalation that could compromise confidentiality, integrity, and availability.

The vulnerability affects phpIPAM, the open‑source IP Address Management suite, in all releases up to and including version 1.8.3. The issue originates from the User API module.

The CVSS base score of 8.6 indicates a high severity. Because the flaw resides in a web API that is exposed over the network, it can be leveraged remotely. No publicly listed KEV exploits exist for this defect, and the EPSS score is unavailable; however, the high CVSS suggests that the vulnerability can be abused with relatively little effort if the API is reachable. Attackers can simply request the problematic endpoint with an unauthorized or leaked token, bypass authentication, and gain administrator or all‑user privileges, thereby exposing sensitive IP management data and allowing further manipulation of the system. No official fix is available, so mitigations must rely on custom patches or operational controls.