---
id: CVE-2026-108720
title: >-
  phpIPAM through 1.8.3 contains a missing authorization vulnerability that
  allows authenticated low-privilege users to view restricted subnets and
  addresses because customer, location and NAT pages skip
  Subnets::check_permission
summary: >-
  phpIPAM through 1.8.3 contains a missing authorization vulnerability that
  allows authenticated low-privilege users to view restricted subnets and
  addresses because customer, location and NAT pages skip
  Subnets::check_permission. Attacker…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-862
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T14:17:20.033'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108720'
references:
  - url: 'https://github.com/phpipam/phpipam'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/customers/customer/objects/ipaddresses.php#L69-L110
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/locations/single-location.php#L129-L195
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/nat/nat_details.php#L16-L45
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/phpipam-through-1.8.3-missing-authorization-in-customers-locations-and-nat-pages
    label: disclosure@vulncheck.com
  - url: 'https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00349
epssPercentile: 0.28303
ingestedAt: '2026-10-11T13:51:17.027Z'
vendor: phpipam
product: phpipam
affected:
  - phpipam <= 1.8.3
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T13:14:33.366495Z'
---

## Overview

phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.