CVE-2026-108720 in phpIPAM
Summary
by MITRE • 10/11/2026
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in phpIPAM versions up to 1.8.3 represents a critical failure in role-based access control mechanisms within the application's web interface. This flaw specifically affects authenticated users who possess low-privilege accounts, allowing them to bypass intended security restrictions and access sensitive network infrastructure data that should be restricted to higher-level administrators or specific authorized roles. The core of the issue lies in the inconsistent implementation of permission checks across different modules of the phpIPAM application. While certain sections of the software correctly enforce authorization protocols by invoking the Subnets::check_permission function, other critical pages completely omit this security check during their execution flow. This inconsistency creates a significant gap in the defense-in-depth strategy employed by the system, enabling unauthorized data disclosure through specific entry points that fail to validate user permissions before rendering content.
From a technical perspective, the vulnerability manifests when an attacker accesses specific PHP files responsible for displaying customer details, location information, and NAT configurations. The affected endpoints include objects.php for customers, single-location.php for locations, and nat_details.php for network address translation settings. These pages are designed to present detailed metadata about IP addresses, CIDR blocks, hostnames, and MAC addresses associated with specific organizational units or physical sites. Because the Subnets::check_permission function is not called before rendering these views, the application does not verify whether the currently authenticated user has the requisite privileges to view the data contained within those objects. Consequently, any logged-in user can manipulate URL parameters or navigate directly to these endpoints to retrieve information that should be logically isolated based on their assigned role and access rights.
The operational impact of this vulnerability is substantial for organizations relying on phpIPAM for network management and security monitoring. The exposure of IP addresses, CIDR ranges, hostnames, and MAC addresses provides attackers with valuable reconnaissance data that can facilitate further attacks within the internal network. Knowledge of specific subnet structures allows adversaries to map out the network topology more accurately than they could through external scanning alone. Furthermore, the disclosure of MAC addresses and hostnames aids in identifying active devices and their associated services, which is critical for planning targeted exploits such as ARP spoofing, man-in-the-middle attacks, or lateral movement within the compromised environment. This level of information leakage undermines the principle of least privilege and compromises the confidentiality of network inventory data that is often considered sensitive internal intelligence.
This vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves a failure to enforce proper access control policies for authenticated users. Additionally, from an offensive security perspective, this flaw supports ATT&CK technique T1087, specifically the Account Discovery sub-technique, where adversaries gather information about accounts and permissions within a system or network environment. The ability to enumerate restricted resources without elevated privileges is also indicative of CWE-284, Improper Access Control, highlighting a fundamental design error in how resource-level permissions are validated before data retrieval.
To mitigate this vulnerability, administrators must upgrade phpIPAM to version 1.8.4 or later, where the missing authorization checks have been implemented across all affected endpoints. Until an upgrade is feasible, organizations should consider implementing compensating controls such as web application firewall rules that restrict direct access to these specific PHP files for low-privilege user sessions. It is also advisable to review and audit existing role definitions within phpIPAM to ensure that the separation of duties between administrative functions and standard viewing privileges is clearly defined and enforced at a higher level, potentially through external authentication proxies or additional application-layer security measures that validate permissions before allowing access to sensitive network data pages.