CVE-2026-97818: phpIPAM Authorization Bypass Vulnerability

CVE-2026-97818 Overview

CVE-2026-97818 is an incorrect authorization vulnerability in phpIPAM through version 1.8.3. The flaw resides in api/controllers/User.php and affects how the API handles the special identifiers id=="admins" and id=="all". An unauthenticated remote attacker can abuse this logic over the network to access user information that should be restricted by authorization checks. The weakness maps to CWE-863: Incorrect Authorization.

Critical Impact
Attackers can bypass authorization in the phpIPAM User API to read user data belonging to the admins group or all users, exposing sensitive account information without valid credentials.

Affected Products

phpIPAM versions through 1.8.3
phpIPAM API component api/controllers/User.php
Deployments exposing the phpIPAM REST API to untrusted networks

Discovery Timeline

2026-09-25 - CVE-2026-97818 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-97818

Vulnerability Analysis

phpIPAM is an open-source IP address management application that exposes a REST API for managing users, subnets, and address space. The User.php API controller contains authorization logic that fails to correctly validate requests when the id parameter equals the reserved strings admins or all. Instead of treating these values as privileged selectors that require elevated permissions, the controller processes them as ordinary identifiers and returns matching records. The result is a broken access control condition where attackers can enumerate administrative accounts or every user in the system through a single API call. See the vulnerable code region in the GitHub phpIPAM User Controller.

Root Cause

The root cause is an incorrect authorization check in api/controllers/User.php at lines 143 to 146. The controller compares the request id field without enforcing a permission gate for the magic values admins and all. Because the identifier bypasses the normal single-user lookup path, the response includes grouped or global user data that higher-privileged roles should exclusively access. This design flaw gives any API caller the ability to query data sets intended only for administrators.

Attack Vector

The attack vector is network-based and requires no user interaction. An attacker issues an HTTP request to the phpIPAM API users endpoint, substituting admins or all for the expected numeric user ID. The server processes the request through the vulnerable branch and returns user records in the API response. Because the vulnerability affects a scope change in confidentiality, exposed data may include usernames, roles, email addresses, and other account metadata used to pivot further into the environment.

No verified public exploit code is available at the time of publication. Technical reference material for the vulnerable code path is available in the GitHub phpIPAM User Controller.

Detection Methods for CVE-2026-97818

Indicators of Compromise

API access logs containing requests to /api/<app_id>/user/admins/ or /api/<app_id>/user/all/ from unexpected source IP addresses.
Unusual spikes in GET requests to the phpIPAM user API endpoint from a single client or scanning infrastructure.
Responses from the User API returning multiple records to callers that typically only query their own account.

Detection Strategies

Inspect web server and application logs for the literal strings admins and all in the URL path segment following the user endpoint.
Correlate API error rates and large JSON response sizes on the User controller to identify enumeration attempts.
Deploy web application firewall (WAF) rules that flag or block requests where the user identifier is non-numeric.

Monitoring Recommendations

Forward phpIPAM access logs to a centralized logging platform and alert on authorization-sensitive endpoints.
Monitor outbound data volume from the phpIPAM host for anomalies consistent with bulk user record extraction.
Baseline normal API client behavior and alert when callers deviate by querying privileged selectors.

How to Mitigate CVE-2026-97818

Immediate Actions Required

Restrict network access to the phpIPAM API using firewall rules, VPN, or reverse proxy allowlists until a patched release is deployed.
Rotate API keys and administrative credentials that may have been exposed through the vulnerable endpoint.
Audit phpIPAM user accounts and recent API activity for unauthorized reads against the admins and all selectors.

Patch Information

Review the vendor release notes for phpIPAM Release v1.8.3 and upgrade to a version that corrects the authorization check in api/controllers/User.php. Verify the fix by confirming that API requests to user/admins and user/all require appropriate privileges and return an authorization error for unprivileged callers.

Workarounds

Disable the phpIPAM REST API if it is not required for operations.
Place the API behind an authenticating reverse proxy that rejects requests where the user identifier is not an integer.
Apply WAF or ingress filtering to drop requests matching the pattern /api/*/user/(admins|all).

bash

# Example NGINX location block to block vulnerable identifiers
location ~* /api/[^/]+/user/(admins|all)(/|$) {
    return 403;
}