CVE-2026-67602 phpipam CVE debrief

Who should care

phpIPAM users, administrators, and security teams should assess their exposure and take necessary actions to mitigate the vulnerability. This includes verifying phpIPAM versions and configurations, applying the patch from version 1.8.2, and implementing additional security measures to prevent exploitation. Security teams should prioritize patching and review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-67602 is a critical authentication bypass vulnerability in phpIPAM's REST API, allowing full API access without authentication. phpIPAM users, administrators, and security teams should assess their exposure and prioritize patching to version 1.8.2 or later.

• Attackers can gain full API access without authentication, allowing for unauthorized read, write, and delete operations on IP address management records.
• The vulnerability requires verification of phpIPAM versions and configurations to determine exposure.
• Remediation priority is high, as patching to version 1.8.2 or later can fix the vulnerability.
• Further verification is needed to determine the full scope of affected versions and potential impact.

Technical summary

The vulnerability is caused by an insecure object cache keying mechanism in phpIPAM's REST API, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records. The vulnerability affects phpIPAM versions prior to 1.8.2 and requires verification of phpIPAM versions and configurations to determine exposure. The vulnerability has a CVSS score of 9.3, indicating a critical severity level. phpIPAM users and administrators should assess their exposure and prioritize patching to version 1.8.2 or later.

Defensive priority

phpIPAM users should prioritize verifying their exposure and applying the patch from version 1.8.2, as the vulnerability allows for full API access without authentication.

Recommended defensive actions

• Verify exposure by checking the phpIPAM version and configuration
• Apply the patch from version 1.8.2 to fix the vulnerability
• Restrict API access to trusted sources and implement additional authentication mechanisms
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score. However, the vendor and affected versions are not clearly stated, requiring further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.