CVE and update status of the FreeBSD ports tree3,296 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-67602

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

Score
9.3 critical
Published
2026-08-24
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
net-mgmt/phpipamphpipam1.6.0unaddressedjake@xz.cx

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>phpipam</name>
	<range><lt>1.8.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>phpIPAM before 1.8.2 contains an authentication bypass vulnerability
	in the REST API that allows unauthenticated attackers to gain full API
	access by exploiting an insecure object cache keying mechanism. The
	cache is keyed by lookup value alone without including the searched
	column, enabling an entry written during an app_id lookup to satisfy a
	subsequent app_code lookup, allowing attackers to use the numeric
	database row identifier as an API token to read, write, and delete all
	IP address management records.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-67602</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-67602</url>
    </references>
    <dates>
      <discovery>2026-08-24</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>