A vulnerability in phpIPAM versions prior to 1.8.2 exposes sensitive subnet information to unauthenticated attackers.

The software contains an authorization bypass vulnerability (CWE-639) triggered by user-controlled keys. The vulnerability permits an unauthenticated attacker to access restricted subnet data by manipulating parameters.

Successful exploitation allows unauthorized users to view sensitive network infrastructure details, which can be leveraged for reconnaissance. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to network security, as attackers can map internal assets and plan further intrusions.

Immediate Action: Upgrade to phpIPAM version 1.8.2 or later to apply the necessary authorization checks.

Proactive Monitoring: Monitor access logs for unusual patterns of requests targeting subnet management parameters or unexpected data retrieval sequences.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the affected endpoints and validate input parameters at the network perimeter.

Public Exploit Available: No confirmed public exploit (exploit_available: false).

Organizations utilizing phpIPAM must prioritize this update, as the ability for an unauthenticated user to bypass authorization controls allows for immediate and simple data theft. Apply the vendor-supplied patch to version 1.8.2 immediately to neutralize the risk.