Is CVE-2026-97818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97818 being exploited in the wild.

How severe is CVE-2026-97818?

High severity, with a CVSS score of 8.6, published 25 September 2026.

Is there a fix for CVE-2026-97818?

A patch was published on 2026-09-25: Fixed in release after 1.8.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97818 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-97818?

Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97818: phpIPAM authorization bypass in User API controller

CVE-2026-97818 · Severity: high · CVSS 8.6 · Published 2026-09-25

phpIPAM is an IP address management web application used by organizations to track and manage network resources. A flaw in the user management API allows attackers to bypass authorization checks when performing actions on privileged accounts and groups, potentially leading to unauthorized modification of administrator accounts or mass user operations.

Technologies: Phpipam. Vendors: Phpipam.

Quick answers

Is CVE-2026-97818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97818 being exploited in the wild.
How severe is CVE-2026-97818?: High severity, with a CVSS score of 8.6, published 25 September 2026.
Which products and versions are affected?: Phpipam through 1.8.3.
Is there a fix for CVE-2026-97818?: A patch was published on 2026-09-25: Fixed in release after 1.8.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97818 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-97818?: Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in api/controllers/User.php where authorization checks fail to properly validate requests with id=="admins" or id=="all", allowing insecure direct object references. An authenticated attacker can bypass authorization controls to manipulate user accounts or perform actions on all users without proper permissions. The flaw affects phpIPAM through version 1.8.3 and is fixed in later releases.

Affected products

phpIPAM phpIPAM through 1.8.3

Timeline

2026-09-25: disclosed
2026-09-25: patched: Fixed in release after 1.8.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.