CVE-2026-75105

HIGH 7.5

phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).

CWE	CWE-639
Vendor	phpipam
Product	phpipam
Published	Aug 17, 2026

Stay Ahead of the Next One

Get instant alerts for phpipam phpipam

Be the first to know when new high vulnerabilities affecting phpipam phpipam are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Affected Versions

phpipam / phpipam

0 < 1.8.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/phpipam/phpipam/issues/4623 github.com: https://github.com/phpipam/phpipam github.com: https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea github.com: https://github.com/phpipam/phpipam/releases/tag/v1.8.2 vulncheck.com: https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter

Credits

🔍 geo-chen