phpIPAM up to 1.8.1 app/temp_share/index.php subnetId improper authorization

Summaryinfo

A vulnerability was found in phpIPAM up to 1.8.1. It has been classified as problematic. This issue affects some unknown processing of the file app/temp_share/index.php. This manipulation of the argument subnetId causes improper authorization. This vulnerability is tracked as CVE-2026-75105. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in phpIPAM up to 1.8.1. It has been declared as problematic. Affected by this vulnerability is an unknown code block of the file app/temp_share/index.php. The manipulation of the argument subnetId with an unknown input leads to a improper authorization vulnerability. The CWE definition for the vulnerability is CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality. The summary by CVE is:

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).

The advisory is shared at github.com. This vulnerability is known as CVE-2026-75105 since 08/17/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1548.002 for this issue.

By approaching the search of inurl:app/temp_share/index.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.8.2 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• phpIPAM

Version

• 1.8.0
• 1.8.1

License

• free

Website

• Product: https://github.com/phpipam/phpipam/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion