CVE-2026-108720: phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

Q: Who can exploit this issue?

An authenticated low-privilege phpIPAM user can exploit it. The attacker does not need user interaction and can access data from sections for which they lack permission.

Q: What information can be disclosed?

The affected pages can expose restricted subnet and address information, including IP addresses, CIDRs, hostnames, and MAC addresses.

Q: Which application areas are affected?

The issue affects customer, location, and NAT pages, including customer objects.php, single-location.php, and nat_details.php. These pages skip the Subnets::check_permission authorization check.

Q: Are deployments affected by default?

The provided information does not identify a special configuration requirement. Exposure depends on having authenticated low-privilege users and restricted subnet data reachable through the affected customer, location, or NAT pages.

Published Oct 11, 2026

Updated

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::checkpermission. Attackers can open customer objects.php, single-location.php or natdetails.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.

Affected Software

1 affected component

Phpipam Phpipam<=1.8.3

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Event

via NVD·02:46 PM

Frequently Asked Questions

Who can exploit this issue?

An authenticated low-privilege phpIPAM user can exploit it. The attacker does not need user interaction and can access data from sections for which they lack permission.

What information can be disclosed?

The affected pages can expose restricted subnet and address information, including IP addresses, CIDRs, hostnames, and MAC addresses.

Which application areas are affected?

The issue affects customer, location, and NAT pages, including customer objects.php, single-location.php, and nat_details.php. These pages skip the Subnets::check_permission authorization check.

Are deployments affected by default?

The provided information does not identify a special configuration requirement. Exposure depends on having authenticated low-privilege users and restricted subnet data reachable through the affected customer, location, or NAT pages.

CVE-2026-108720: phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

Which application areas are affected?

Are deployments affected by default?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be disclosed?

Which application areas are affected?

Are deployments affected by default?