CVE-2026-97818 in phpIPAM
Summary
by MITRE • 09/25/2026
phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified in phpIPAM versions up to 1.8.3 represents a critical failure in access control mechanisms within the application's API layer, specifically located in the User controller module. This flaw stems from an incorrect authorization logic that fails to properly validate user permissions when handling requests associated with specific identifier values such as "admins" and "all". In secure software architecture, identity verification must be strictly enforced at every entry point, particularly for administrative functions or bulk data operations. The presence of these identifiers suggests endpoints designed to manage administrator accounts or retrieve comprehensive user lists, which inherently require elevated privileges. However, the implementation allows unauthenticated or unauthorized users to interact with these resources by exploiting the flawed logic that treats these specific IDs as valid targets without sufficient permission checks.
From a technical perspective, this issue is classified under CWE-285, Improper Authorization, where an application does not properly verify whether the user has authority for a given action. The root cause lies in the api/controllers/User.php file, which processes API requests related to user management. When a request targets resources identified by "admins" or "all", the system fails to cross-reference the requester's session token and role against an access control list. This oversight permits any actor with network connectivity to the application interface to execute actions intended for privileged users. The vulnerability likely allows attackers to perform sensitive operations such as creating new administrator accounts, modifying existing user permissions, or retrieving detailed information about all registered users, thereby bypassing standard authentication barriers.
The operational impact of this vulnerability is severe due to its potential for complete system compromise. An attacker can leverage this flaw to escalate privileges from a low-level guest account to full administrative control over the phpIPAM instance. Since phpIPAM is often used as a central repository for network infrastructure data, gaining admin access enables the exfiltration of sensitive IP address allocations, subnet configurations, and device details. Furthermore, an attacker could create backdoor accounts that persist even after the initial vulnerability is patched if not monitored closely. This level of unauthorized access undermines the integrity and confidentiality of the entire network management ecosystem supported by the application, potentially leading to further lateral movement within the internal network or disruption of critical IP address management services.
This type of authorization bypass aligns with MITRE ATT&CK technique T1078, Valid Accounts, where adversaries use legitimate credentials or exploit flaws in authentication systems to gain access. Additionally, it relates to T1098, Account Manipulation, as the vulnerability facilitates the creation and modification of user accounts without proper oversight. To mitigate this risk, immediate action is required by upgrading phpIPAM to version 1.8.4 or later where these authorization checks have been corrected. In environments where patching cannot be applied instantly, network segmentation should restrict access to the API endpoints from untrusted networks. Implementing a Web Application Firewall with rules targeting suspicious patterns in user ID parameters can also provide temporary protection while ensuring that all administrative interfaces are protected by multi-factor authentication and strict IP whitelisting policies.