CVE-2026-75105 in phpIPAM
Summary
by MITRE • 08/18/2026
phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability in phpIPAM versions through 1.8.1 represents a critical failure in access control logic within the temporary sharing mechanism designed for subnet visibility. The core technical flaw resides in how the application handles requests to view specific IP address records via shared URLs. When an administrator generates a share token with the scope limited to subnets, the system issues a URL containing parameters that allow recipients to browse or query addresses associated with those subnets. However, the implementation fails to enforce strict boundary checks between the authorized subnet context and the requested resource identifier. Specifically, in the files app/temp_share/index.php and app/temp_share/address.php, when the share type is set to 'subnets', the application accepts a subnetId parameter which it uses directly as a database primary key to fetch address details without verifying that this ID actually corresponds to one of the subnets explicitly authorized by the original sharing action. This lack of validation allows an attacker who possesses any valid, non-expired temporary share URL for a specific subnet to manipulate the request parameters and enumerate identifiers belonging to other sections or subnets entirely outside their intended scope.
From an operational perspective, this flaw enables unauthenticated enumeration of sensitive network inventory data across the entire infrastructure, provided the attacker has at least one valid share link from any part of the system. By systematically iterating through subnetId values, an adversary can retrieve comprehensive records for IP addresses including hostnames, DNS names, MAC addresses, owner and contact information, as well as notes fields. These note fields are particularly dangerous because they frequently contain plaintext credentials, configuration details, or internal documentation that should not be exposed to external parties. The ability to map out the entire network topology and extract sensitive metadata significantly aids in reconnaissance phases of an attack, allowing threat actors to identify high-value targets, understand network segmentation strategies, and potentially prepare for further exploitation such as credential stuffing or lateral movement based on discovered hostnames and MAC addresses.
This vulnerability is best classified under CWE-284 Improper Access Control, specifically reflecting a failure to enforce proper restrictions on the current user regarding access to requested data from outside the permitted scope. It also aligns with CWE-639 Injection of Critical Information into External Resource if one considers how sensitive data in notes could be exfiltrated via external channels, though the primary issue is unauthorized data retrieval. In terms of MITRE ATT&CK framework techniques, this behavior facilitates Discovery through Network Service Scanning or Data from Configuration Repository, as it allows an attacker to gather information about network services and configurations without direct authentication to the main application interface. The vulnerability highlights a common pitfall in web applications where session-based or token-based access controls are not rigorously validated against every individual resource request, assuming that possession of a general share link implies permission for all related resources regardless of their actual association with the authorized context.
Mitigation strategies must focus on implementing strict validation logic within the temporary sharing module. Developers should ensure that any request to fetch an IP address record verifies that the requested subnetId is explicitly listed in the whitelist of subnets associated with the specific share token being used. This requires a database query or memory check at runtime to confirm ownership before returning data. Additionally, input validation should be applied to all parameters derived from user requests to prevent enumeration attacks by limiting response payloads or introducing rate limiting for rapid sequential access patterns. Upgrading to phpIPAM version 1.8.2 or later resolves this issue as the vendor has patched the logic to enforce proper subnet association checks. Until an upgrade is performed, administrators should restrict the availability of temporary share links and monitor logs for unusual enumeration activity targeting the temp_share endpoints.