PhpIPAM (1.8.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/phpipam-1.8.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 18 Aug 2026 00:51:38 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in phpIPAM Temporary Share Featurehttps://feed.craftedsignal.io/briefs/2026-08-phpipam-auth-bypass/Tue, 18 Aug 2026 00:51:38 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-phpipam-auth-bypass/phpIPAM versions up to 1.8.1 contain an authorization vulnerability allowing an unauthenticated attacker with a temporary share token to enumerate and exfiltrate sensitive network inventory data.phpIPAM versions through 1.8.1 contain an authorization vulnerability (CVE-2026-75105) within the temporary share feature. The application fails to verify that a requested IP address belongs to the specific subnet associated with a valid temporary share token. In the files 'app/temp_share/index.php' and 'app/temp_share/address.php', the 'subnetId' parameter is used directly as a database primary key when the share type is set to 'subnets'. This lack of validation allows an unauthenticated user, in possession of any valid, non-expired temporary share URL, to manipulate the 'subnetId' parameter. By iterating through potential IDs, an attacker can enumerate and retrieve IP address records across all sections and subnets. The resulting exposure includes sensitive information such as hostnames, DNS names, MAC addresses, owner details, and potentially notes containing credentials or network configuration details, which poses a significant risk to internal network security.

Impact

Successful exploitation allows unauthorized access to comprehensive network inventory data. This data can be used by an attacker to perform reconnaissance on internal infrastructure, identify high-value targets, and potentially gain access to credentials stored within IPAM notes. The vulnerability affects all deployments of phpIPAM up to version 1.8.1.

Recommendation

  • Upgrade to a patched version of phpIPAM that correctly validates subnet ownership for temporary shares.
  • Audit existing temporary shares for abuse or exposure of sensitive notes.
  • Implement access logging to monitor for anomalous traversal of 'subnetId' parameters in the temporary share module.
  • Restrict access to the phpIPAM management interface to trusted internal networks or via VPN to reduce exposure to unauthorized entities.
]]>highadvisory