Description

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-17T21:16:49.473Z",
  "pubdate": "2026-08-17T21:16:49.473Z",
  "executiveSummary": "phpIPAM through 1.8.1 suffers from an Insecure Direct Object Reference (IDOR) vulnerability that compromises IP address confidentiality across the entire application database. The root cause stems from a failure to perform adequate authorization checks to verify that a requested IP address correlates to the specific subnet associated with an issued temporary share token. Unauthenticated attackers who possess any valid, non-expired temporary share URL can exploit this flaw by manipulating parameters to arbitrarily access sensitive IP address records, including hostnames, DNS names, MAC addresses, owner and contact fields, and notes that may contain sensitive credentials and configuration details. The business impact includes severe information disclosure and unauthorized data harvesting across all sections and subnets. Exploitation requires no prior authentication or elevated privileges, relying solely on the acquisition of a legitimate temporary share token to begin systematic parameter enumeration.",
  "technicalDetails": "The vulnerability resides within the temporary sharing mechanism implemented in phpIPAM through version 1.8.1. Specifically, the vulnerable components are located in the files app/temp_share/index.php and app/temp_share/address.php. When the share type parameter is explicitly configured as subnets, the application processes user-supplied input via the subnetId parameter. The core flaw is that this parameter is used directly as a database primary key to execute queries and fetch address records without validating whether the requested address genuinely belongs to the authorized subnet assigned to the active temporary share token.\nThe attack flow proceeds as follows: An unauthenticated malicious actor obtains a valid, non-expired temporary share URL through legitimate means or previous exposure. Rather than restricting database queries to the boundaries of the authorized subnet, the application trusts the supplied subnetId value. The attacker can then automate requests while systematically incrementing or enumerating the subnetId parameter. Because input validation and access control checks are absent at the database query boundary, the application processes each request and returns the corresponding IP address record.\nThis enumeration technique allows an adversary to read every IP address record across all system sections and subnets. The retrieved data includes critical network intelligence such as hostnames, fully qualified domain names (DNS), media access control (MAC) addresses, owner and contact details, and administrative notes. These notes frequently store high-value auxiliary data, including plain-text credentials and internal network configuration details, significantly lowering the barrier for subsequent lateral movement or further compromise. Network exposure is high as the vulnerable scripts are accessible over standard web protocols to any unauthenticated client presenting a valid token string."
}