{"id":"CVE-2026-75105","summary":"phpIPAM Temporary Subnet Share Information Disclosure via Address Parameter","details":"phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database primary key to fetch an address without confirming the address belongs to the authorized subnet. An unauthenticated party holding any valid, non-expired temporary share URL can enumerate the subnetId parameter to read every IP address record across all sections and subnets, including hostnames, DNS names, MAC addresses, owner/contact fields, and notes (which may contain credentials and configuration details).","modified":"2026-08-25T04:03:52.361780507Z","published":"2026-08-17T20:36:01.403Z","database_specific":{"cwe_ids":["CWE-639"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75105.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75105.json"},{"type":"ADVISORY","url":"https://github.com/phpipam/phpipam/releases/tag/v1.8.2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75105"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/phpipam-temporary-subnet-share-information-disclosure-via-address-parameter"},{"type":"REPORT","url":"https://github.com/phpipam/phpipam/issues/4623"},{"type":"FIX","url":"https://github.com/phpipam/phpipam/commit/2980be03652c0eb1db9fe2bcefaa210c854b9aea"},{"type":"PACKAGE","url":"https://github.com/phpipam/phpipam"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/phpipam/phpipam","events":[{"introduced":"0"},{"fixed":"6e11367e5f43eb9f50bde7f7b25bf65fc53d844d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.8.2"}],"source":"AFFECTED_FIELD"}}],"versions":["v1.8.1","v1.7.4","v1.7.1","v1.7.0","v1.6.0","v1.5.0","v1.3.2","v1.3.0","v1.2.0_beta2","v1.19.008","v1.16.003"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-75105.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}