Authorization Bypass in phpIPAM Temporary Share Feature

phpIPAM versions through 1.8.1 contain an authorization vulnerability (CVE-2026-75105) within the temporary share feature. The application fails to verify that a requested IP address belongs to the specific subnet associated with a valid temporary share token. In the files 'app/temp_share/index.php' and 'app/temp_share/address.php', the 'subnetId' parameter is used directly as a database primary key when the share type is set to 'subnets'. This lack of validation allows an unauthenticated user, in possession of any valid, non-expired temporary share URL, to manipulate the 'subnetId' parameter. By iterating through potential IDs, an attacker can enumerate and retrieve IP address records across all sections and subnets. The resulting exposure includes sensitive information such as hostnames, DNS names, MAC addresses, owner details, and potentially notes containing credentials or network configuration details, which poses a significant risk to internal network security.

Impact

Successful exploitation allows unauthorized access to comprehensive network inventory data. This data can be used by an attacker to perform reconnaissance on internal infrastructure, identify high-value targets, and potentially gain access to credentials stored within IPAM notes. The vulnerability affects all deployments of phpIPAM up to version 1.8.1.

Recommendation

• Upgrade to a patched version of phpIPAM that correctly validates subnet ownership for temporary shares.
• Audit existing temporary shares for abuse or exposure of sensitive notes.
• Implement access logging to monitor for anomalous traversal of 'subnetId' parameters in the temporary share module.
• Restrict access to the phpIPAM management interface to trusted internal networks or via VPN to reduce exposure to unauthorized entities.