CVE-2026-97818: Phpipam

High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days.

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

Affected products

• Phpipam Phpipam: up to and including 1.8.3

Published 2026-09-25. Last modified 2026-10-06.