CVE-2026-75105

phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).

• CWE-639

• https://github.com/phpipam/phpipam
• https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea
• https://github.com/phpipam/phpipam/issues/4623
• https://github.com/phpipam/phpipam/releases/tag/v1.8.2
• https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter

Published

Aug 17, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-75098The Product Designer App plugin for WordPress is vulnerable …7.5
• CVE-2026-75099Unauthenticated REST disclosure of certain content items in …5.3
• CVE-2026-7510A vulnerability was determined in OWAP DefectDojo up to 2.55…6.3
• CVE-2026-75101An authorization bypass vulnerability was identified in GitH…6.5
• CVE-2026-75103Crawlab fails to verify user ownership or administrative rol…8.8
• CVE-2026-75104Hugging Face Transformers fails to validate shard filenames …5.5
• CVE-2026-75106OpnForm derives editable-submission secrets from sequential …9.1
• CVE-2026-75107Grav Form Plugin before 9.1.19 fails to escape field-definit…5.4
• CVE-2026-75108Next Terminal fails to enforce per-asset authorization check…5.4
• CVE-2026-75109Determined fails to authorize requests on the generic task k…7.1
• CVE-2026-7511PKCS7_verify signer confusion allows forged signatures, wher…7.5
• CVE-2026-75110MemOS is a memory operating system for LLMs and AI agents. I…9.8