CVE-2026-67602

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67602
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67602.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-67602
Published
2026-08-24T13:57:42.191Z
Modified
2026-08-30T03:30:22.126027109Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
phpIPAM < 1.8.2 Authentication Bypass via REST API Object Cache
Details

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an appid lookup to satisfy a subsequent appcode lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67602.json",
    "cwe_ids": [
        "CWE-706"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/phpipam/phpipam

Affected ranges

Type
GIT
Repo
https://github.com/phpipam/phpipam
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6e11367e5f43eb9f50bde7f7b25bf65fc53d844d
Fixed
d29728fecca327f1ea825798908d0cfa4c62408e
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.8.2"
        }
    ]
}

Affected versions

v1.*
v1.16.003
v1.19.008
v1.2.0_beta2
v1.3.0
v1.3.2
v1.5.0
v1.6.0
v1.7.0
v1.7.1
v1.7.4
v1.8.0
v1.8.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67602.json"