Critical severity · published Aug 24, 2026
CVE-2026-67602
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
9.1
CVSS
0.6%
EPSS
No
On KEV
Description
phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
phpipam · phpipam
before 1.8.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67602
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67602
release-notes
https://github.com/phpipam/phpipam/releases/tag/v1.8.2
patch
https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e
third-party-advisory
https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache
More from phpipam
9.8
CVE-2022-41443
phpipam v1.5.0 was discovered to contain a header injection vulnerability via the component /admin/subnets/ripe-query.php
9.8
CVE-2019-16696
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit.php table parameter when action=add is used
9.8
CVE-2019-16695
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/filter.php table parameter when action=add is used
9.8
CVE-2019-16694
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/edit-result.php table parameter when action=add is used
9.8
CVE-2019-16693
phpIPAM 1.4 allows SQL injection via the app/admin/custom-fields/order.php table parameter when action=add is used