CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e
https://github.com/phpipam/phpipam/releases/tag/v1.8.2
https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) phpIPAM anterior a la versión 1.8.2 contiene una vulnerabilidad de omisión de autenticación en la API REST que permite a atacantes no autenticados obtener acceso completo a la API explotando un mecanismo inseguro de clave de caché de objetos. La caché se indexa solo por el valor de búsqueda sin incluir la columna buscada, lo que permite que una entrada escrita durante una búsqueda de app_id satisfaga una búsqueda posterior de app_code, permitiendo a los atacantes usar el identificador numérico de fila de la base de datos como un token de API para leer, escribir y eliminar todos los registros de gestión de direcciones IP.

Information

Published : 2026-08-24 14:16

Updated : 2026-10-14 13:10

NVD link : CVE-2026-67602

Mitre link : CVE-2026-67602

CVE.ORG link : CVE-2026-67602

JSON object : View

Products Affected

No product.

CWE

CWE-706

Use of Incorrectly-Resolved Name or Reference

{"id": "CVE-2026-67602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-67602", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T18:49:39.217151Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/phpipam/phpipam", "vendor": "phpipam", "product": "phpipam", "versions": [{"status": "affected", "version": "0", "lessThan": "1.8.2", "versionType": "semver"}], "packageURL": "pkg:github/phpipam/phpipam", "defaultStatus": "affected"}]}], "published": "2026-08-24T14:16:57.347", "references": [{"url": "https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/phpipam/phpipam/releases/tag/v1.8.2", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-706"}]}], "descriptions": [{"lang": "en", "value": "phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records."}, {"lang": "es", "value": "phpIPAM anterior a la versi\u00f3n 1.8.2 contiene una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en la API REST que permite a atacantes no autenticados obtener acceso completo a la API explotando un mecanismo inseguro de clave de cach\u00e9 de objetos. La cach\u00e9 se indexa solo por el valor de b\u00fasqueda sin incluir la columna buscada, lo que permite que una entrada escrita durante una b\u00fasqueda de app_id satisfaga una b\u00fasqueda posterior de app_code, permitiendo a los atacantes usar el identificador num\u00e9rico de fila de la base de datos como un token de API para leer, escribir y eliminar todos los registros de gesti\u00f3n de direcciones IP."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "disclosure@vulncheck.com"}