CVE-2026-67602

Name of the Vulnerable Software and Affected Versions phpIPAM versions prior to 1.8.2

Description An authentication bypass exists in the REST API due to an insecure object cache keying mechanism. The cache uses only the lookup value as a key and fails to include the searched column. This allows an entry created during an app id lookup to be used for a subsequent app code lookup. Consequently, unauthenticated attackers can use a numeric database row identifier as an API token to read, write, and delete all IP address management records.

Recommendations Update to version 1.8.2 or later.