{"id":"CVE-2026-75105","title":"phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for","summary":"phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId pa…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-639"],"vendor":"phpipam","product":"phpipam","affected":["phpipam < 1.8.2"],"published":"2026-08-17","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:02:50.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75105","references":[{"url":"https://github.com/phpipam/phpipam","label":"disclosure@vulncheck.com"},{"url":"https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea","label":"disclosure@vulncheck.com"},{"url":"https://github.com/phpipam/phpipam/issues/4623","label":"disclosure@vulncheck.com"},{"url":"https://github.com/phpipam/phpipam/releases/tag/v1.8.2","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00482,"epssPercentile":0.38869,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-20T13:48:29.426806Z"},"ingestedAt":"2026-09-24T15:45:56.704Z","slug":"CVE-2026-75105","body":"## Overview\n\nphpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}