CVE-2026-75105: phpIPAM Information Disclosure Vulnerability

CVE-2026-75105 Overview

CVE-2026-75105 is an Insecure Direct Object Reference vulnerability [CWE-639] in phpIPAM through version 1.8.1. The application fails to verify that a requested IP address record belongs to the subnet authorized by a temporary share token. An unauthenticated attacker holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read IP address records across all sections and subnets in the database.

Critical Impact
Unauthenticated attackers with a single valid share URL can enumerate every IP address record in phpIPAM, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes fields that may contain credentials.

Affected Products

phpIPAM through version 1.8.1
app/temp_share/index.php component
app/temp_share/address.php component

Discovery Timeline

2026-08-17 - CVE-2026-75105 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75105

Vulnerability Analysis

phpIPAM implements a temporary share feature that generates URLs allowing external users to view specific subnets or addresses without authentication. When the share type is subnets, the token authorizes access to a specific subnet identified in $temp_objects.

The flaw is an authorization boundary failure. In app/temp_share/index.php and app/temp_share/address.php, the subnetId parameter supplied by the client is passed directly to the database as a primary key to fetch an address record. The code does not verify that the returned address belongs to the subnet the share token was actually issued for.

An attacker holding one legitimate temp share URL can iterate subnetId values sequentially. Each request returns full address record content including hostname, DNS name, MAC address, owner and contact fields, and free-form notes. Administrators commonly store credentials, VLAN configuration, and infrastructure documentation in the notes field.

Root Cause

The root cause is a missing authorization check between the presented share token and the requested database object. The application trusts client-supplied identifiers instead of enforcing that the requested resource matches the scope of the token. This pattern maps directly to [CWE-639: Authorization Bypass Through User-Controlled Key].

Attack Vector

Exploitation requires network access to the phpIPAM instance and a valid, non-expired temporary share URL. The attacker submits requests to the temp-share endpoints while varying the subnetId query parameter. No authentication, no user interaction, and no elevated privileges are required beyond possession of a single share link.

php

// Patch excerpt from app/temp_share/index.php
// Source: https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea

# disabled
if($settings->tempShare!=1) { $Result->show("danger", _("Temporary sharing disabled"), false); }
# none
- elseif(sizeof($temp_objects)==0)
+ elseif(!is_array($temp_objects))
    { $Log->write( _("Tempory share access"), $GET->section, 2);
      $Result->show("danger", _("Invalid share key"), false); }
# try to fetch object
elseif(!array_key_exists($GET->section, $temp_objects))
    { $Log->write( _("Tempory share access"), $GET->section, 2);
      $Result->show("danger", _("Invalid share key"), false); }

The patch tightens validation of $temp_objects and introduces separate CSRF tokens for temp-share flows in app/subnets/subnet-details/subnet-details.php.

Detection Methods for CVE-2026-75105

Indicators of Compromise

Repeated HTTP requests to /app/temp_share/index.php or /app/temp_share/address.php with sequentially incrementing subnetId values from a single source IP.
High-volume access to temp-share endpoints from unauthenticated sessions outside of expected sharing recipients.
Log entries labeled Tempory share access appearing in bursts across multiple section identifiers.

Detection Strategies

Alert on temp-share requests where the ratio of distinct subnetId values per source IP exceeds a baseline threshold within a short time window.
Correlate temp-share URL access with the originally authorized subnet scope; flag requests referencing subnets outside that scope.
Monitor phpIPAM application logs for repeated Invalid share key responses immediately followed by successful address.php responses.

Monitoring Recommendations

Ingest phpIPAM web server access logs and application logs into a centralized SIEM for behavioral correlation.
Track outbound access patterns from any host that received a temp-share link to identify unauthorized redistribution.
Review historical logs from before the patch date for enumeration patterns against subnetId parameters.

How to Mitigate CVE-2026-75105

Immediate Actions Required

Upgrade phpIPAM to version 1.8.2 or later, which contains commit 2980be0.
Revoke all active temporary share tokens and reissue only those still required after the upgrade.
Audit notes, owner, and contact fields for any stored credentials and rotate exposed secrets.

Patch Information

The upstream fix is delivered in phpIPAM release v1.8.2 via commit 2980be0. Additional context is available in the VulnCheck advisory and GitHub Issue #4623.

Workarounds

Disable temporary sharing by setting tempShare to 0 in phpIPAM settings until the upgrade is applied.
Restrict network access to the phpIPAM instance so that temp-share URLs are only reachable from trusted networks or through a VPN.
Enforce a policy prohibiting storage of credentials or sensitive configuration data in phpIPAM notes fields.

bash

# Disable temp-share via database until patch is applied
mysql -u phpipam -p phpipam -e "UPDATE settings SET tempShare=0;"

# Verify installed version after upgrade
grep VERSION /var/www/html/phpipam/config.php