phpIPAM through version 1.8.1 does not properly verify that an IP address requested via a temporary share token belongs to the subnet for which the token was issued. Specifically, in app/temp_share/index.php and app/temp_share/address.php, when the share type is 'subnets', the subnetId parameter is used directly as a database key to fetch address records without confirming the address's subnet membership. This flaw enables an unauthenticated attacker holding any valid, non-expired temporary share URL to enumerate the subnetId parameter and retrieve IP address records from all subnets and sections, potentially exposing sensitive network information.

An unauthenticated attacker with access to any valid temporary share URL can enumerate IP address records across all subnets and sections, gaining access to sensitive information including hostnames, DNS names, MAC addresses, owner/contact fields, and notes. The notes may contain credentials and configuration details, leading to a high confidentiality impact. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to temporary share URLs and monitor their distribution carefully to prevent unauthorized enumeration. Avoid sharing temporary URLs publicly or with untrusted parties.