Executive brief
OpenWISP IPAM is a multi-tenant IP address management system used by network operators (WISPs) to manage subnets and IP allocations across multiple organizations. A flaw in its CSV export feature allows a user belonging to one organization to read the complete inventory of another organization's subnets and IP addresses if they know the subnet's identifier. This breaks the multi-tenant isolation and exposes another tenant's network topology and host details, though exploiting it requires first obtaining the target subnet's UUID through leaked URLs, logs, or shared exports.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the ExportSubnetView.post() API endpoint. While the corresponding ImportSubnetView correctly calls assert_organization_permissions() to verify the user belongs to the target organization before processing imports, ExportSubnetView bypasses this check entirely and calls export_csv() with only the subnet UUID. The export_csv() method resolves the subnet via Subnet.objects.get(pk=subnet_id) with no organization-scope filter, allowing access to any subnet in the system. The subnet_id is a random UUIDField, so an attacker must obtain the target subnet's UUID (leaked via URLs, logs, or shared CSV exports) rather than enumerate it, resulting in high attack complexity. Similar patterns exist in AvailableIpView.get() and RequestIPView.post() (the latter also permits unauthorized writes). The fix requires adding assert_organization_permissions() to these views or resolving objects through the organization-scoped queryset. Patches are available in version 1.2.1.
Affected products
- OpenWISP openwisp-ipam <= 1.2.0.post1
Timeline
- 2026-06-15: disclosed: Initial advisory published
- 2026-08-26: patched: Fix released in version 1.2.1