Missing Authorization Vulnerability in phpIPAM Affects Low-Privilege User Access

CVE-2026-108720

What is CVE-2026-108720?

In phpIPAM versions up to 1.8.3, an insufficiency in the authorization mechanism allows authenticated low-privilege users to access sensitive information intended for higher-privileged users. This vulnerability arises from the Subnets::check_permission function being bypassed on customer, location, and NAT pages. As a result, attackers can exploit this flaw to retrieve restricted data, including IP addresses, CIDRs, hostnames, and MAC addresses through unauthorized access to specific pages. Immediate action is recommended to secure your systems and prevent unauthorized data exposure.

References