CVE-2026-108720 — phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, loc…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7