Description

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-09-25T05:17:08.120Z",
  "pubdate": "2026-09-25T05:17:08.120Z",
  "executiveSummary": "An incorrect authorization vulnerability exists in phpIPAM through version 1.8.3, specifically within the User controller component.\nThe vulnerability allows unauthorized or improperly privileged actors to interact with restricted API endpoints defined by the 'admins' and 'all' identifier parameters.\nSuccessful exploitation permits unauthorized users to bypass intended access control mechanisms, potentially exposing sensitive user data or administrative configuration details.\nThe flaw stems from insufficient validation of authorization tokens or roles when processing specific user-related API requests in api/controllers/User.php.\nThis vulnerability poses a significant security risk by compromising the confidentiality and integrity of the application's user management subsystem.\nThe impact depends on the specific actions performed through the API; however, unauthorized information disclosure or unauthorized administrative actions are likely outcomes.\nExploitation requires network access to the target phpIPAM instance and the ability to craft and send API requests targeting the identified vulnerable endpoints.",
  "technicalDetails": "The vulnerability is located in the api/controllers/User.php file of phpIPAM, which manages user-related API interactions.\nThe root cause is a failure in the authorization logic when handling requests where the 'id' parameter is set to 'admins' or 'all'.\nIn the affected versions (up to 1.8.3), the controller fails to properly verify if the authenticated user has sufficient administrative privileges before executing the logic associated with these specific identifiers.\nNormally, these endpoints are intended to restrict data retrieval or operations to authorized administrators. However, due to the flawed authorization check, the API allows unauthorized requests to proceed, bypassing established access control lists (ACLs).\nThe attack flow involves an adversary sending a crafted HTTP GET request to the phpIPAM API endpoint mapped to the User controller. By specifying 'admins' or 'all' in the request parameters, an unprivileged user can trigger the backend code to return sensitive information that should be restricted.\nThe controller logic assumes that the 'id' parameter behaves as a standard user identifier, but the inclusion of 'admins' or 'all' triggers a logic branch that inadvertently elevates the context of the query or lacks a secondary, robust authorization check.\nConsequently, the application returns comprehensive lists of users or configuration metadata related to administrative accounts. An attacker does not need high-level privileges to perform this action, effectively escalating their access to data that would otherwise be protected.\nThe post-exploitation impact includes the potential for full user enumeration, disclosure of account metadata, and potential preparation for further attacks such as targeted phishing or brute-force attempts on administrative credentials."
}