phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and… (CVE-2026-108720)

phpIPAM through version 1.8.3 contains a missing authorization vulnerability (CWE-862) where authenticated low-privilege users can access restricted subnet and address data. The vulnerability arises because the customer, location, and NAT pages skip the Subnets::check_permission function, allowing unauthorized read access to sensitive network information such as IP addresses, CIDRs, hostnames, and MAC addresses via customer objects.php, single-location.php, or nat_details.php.

An attacker with valid low-privilege credentials can view sensitive network information that should be restricted, including IP addresses, CIDRs, hostnames, and MAC addresses. This exposure could aid in network reconnaissance but does not allow modification or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to phpIPAM interfaces to trusted users and monitor for unauthorized access attempts.