Quick answers
- Is CVE-2026-67602 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-67602 being exploited in the wild.
- How severe is CVE-2026-67602?
- Critical severity, with a CVSS score of 9.1, published 24 August 2026.
- Which products and versions are affected?
- Phpipam before 1.8.2.
- Is there a fix for CVE-2026-67602?
- A patch was published on 2026-08-16: phpIPAM v1.8.2 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-67602 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-67602?
- Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass in the REST API caused by an insecure object cache keying mechanism. The cache lookup key includes only the search value without including the searched column name, creating a collision scenario where an entry written during an app_id lookup can satisfy a subsequent app_code lookup. An attacker can exploit this by using a numeric database row identifier as an API token, bypassing authentication entirely and gaining the ability to read, write, and delete IP address management records. The vulnerability affects phpIPAM before version 1.8.2 and is fixed in v1.8.2 released on August 16, 2026.
Affected products
- phpIPAM phpIPAM before 1.8.2
Timeline
- 2026-08-24: disclosed: CVE-2026-67602 published
- 2026-08-16: patched: phpIPAM v1.8.2 released with security fixes
- 2026-08-06: other: Security fix committed to repository