CVE-2026-108720: phpIPAM Authorization Bypass Vulnerability

CVE-2026-108720 Overview

CVE-2026-108720 is a missing authorization vulnerability [CWE-862] affecting phpIPAM through version 1.8.3. The flaw lets authenticated low-privilege users read restricted subnets and IP addresses they should not access. The customer, location, and Network Address Translation (NAT) pages fail to invoke the Subnets::check_permission method before returning data. Attackers with valid credentials can request customer objects.php, single-location.php, or nat_details.php to disclose IP addresses, Classless Inter-Domain Routing (CIDR) ranges, hostnames, and Media Access Control (MAC) addresses from sections outside their permission scope.

Critical Impact
Authenticated users can enumerate network inventory data from restricted sections, exposing IP allocations, hostnames, and MAC addresses that support reconnaissance for follow-on attacks.

Affected Products

phpIPAM through version 1.8.3
Deployments exposing app/tools/customers/customer/objects/ipaddresses.php
Deployments exposing app/tools/locations/single-location.php and app/tools/nat/nat_details.php

Discovery Timeline

2026-10-11 - CVE-2026-108720 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108720

Vulnerability Analysis

phpIPAM centralizes IP address management and enforces per-section permissions through the Subnets::check_permission function. Standard subnet and address views call this function before rendering data. The customer, location, and NAT tool pages skip the check entirely. An authenticated user with the lowest role can request those pages directly and receive content assembled from subnets owned by other sections.

The returned data includes IP addresses, CIDR blocks, hostnames, and MAC addresses. This information supports network reconnaissance, identification of high-value hosts, and planning of lateral movement across segmented environments.

Root Cause

The root cause is a missing authorization check [CWE-862] in three tool endpoints. The handlers in ipaddresses.php (lines 69–110), single-location.php (lines 129–195), and nat_details.php (lines 16–45) query address and subnet data without validating that the requesting user has permission on the parent section. See the HackMD PHPIPAM Tools Disclosure for the full code analysis.

Attack Vector

Exploitation requires only valid phpIPAM credentials at any permission level. The attacker issues authenticated HTTP GET requests to the vulnerable tool endpoints with customer, location, or NAT identifiers. The server returns IP inventory data without evaluating section-level access control. No user interaction and no elevated privileges are required beyond standard login.

For the full endpoint analysis, review the VulnCheck PHPIPAM Advisory and the GitHub PHPIPAM Repository.

Detection Methods for CVE-2026-108720

Indicators of Compromise

Authenticated HTTP requests to app/tools/customers/customer/objects/ipaddresses.php from accounts without permission to the referenced sections.
Access patterns to app/tools/locations/single-location.php or app/tools/nat/nat_details.php iterating sequential location or NAT identifiers.
Low-privilege sessions issuing high volumes of tool-page requests in short windows, consistent with enumeration.

Detection Strategies

Correlate web server access logs with phpIPAM session role data to identify requests to the three tool endpoints from users lacking section permissions.
Alert on repeated 200-status responses to nat_details.php or single-location.php requests that iterate numeric id parameters.
Baseline normal usage of customer and location tools per role, then flag deviations by low-privilege accounts.

Monitoring Recommendations

Forward phpIPAM web server logs and database audit logs to a central log platform for role-aware correlation.
Monitor outbound queries from phpIPAM to downstream systems for signs that disclosed hostnames or IP ranges are being probed.
Track authentication events for low-privilege accounts that suddenly begin accessing tool pages they have not used historically.

How to Mitigate CVE-2026-108720

Immediate Actions Required

Restrict access to the phpIPAM web interface to trusted networks and authenticated administrators where feasible.
Audit user roles and remove unneeded low-privilege accounts that could be used to enumerate network data.
Review access logs for the three vulnerable endpoints and investigate requests from accounts without section permissions.

Patch Information

No fixed version is identified in the published advisory at the time of writing. Monitor the GitHub PHPIPAM Repository and the VulnCheck PHPIPAM Advisory for a release that adds the missing Subnets::check_permission calls in ipaddresses.php, single-location.php, and nat_details.php.

Workarounds

Block or restrict access to app/tools/customers/, app/tools/locations/, and app/tools/nat/ at the web server or reverse proxy for non-administrative users.
Enforce multi-factor authentication (MFA) on phpIPAM accounts to reduce the risk of credential-based abuse.
Apply role-based network segmentation so that compromised low-privilege sessions cannot reach administrative tooling.

bash

# Example nginx snippet restricting vulnerable tool paths to an admin ACL
location ~ ^/app/tools/(customers|locations|nat)/ {
    allow 10.0.0.0/24;    # admin management subnet
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}