The CVSS 7.5 score for CVE-2026-75105 significantly understates the actual risk. This vulnerability in phpIPAM's temporary share mechanism doesn't merely expose IP addresses—it exposes your organization's complete network asset inventory, and the notes field elevates that from reconnaissance data to credential compromise.
The vulnerability allows enumeration of IP records across all sections and subnets, not just the subnet a share token is scoped to. An attacker with any valid, non-expired share URL—obtained through social engineering, accidental email exposure, or document leaks—can map your entire IP infrastructure: subnets, devices, ownership, and descriptions. For an attacker planning targeted operations, this is intelligence-grade information.
What the CVSS framework cannot weight is the notes field. IPAM systems are where engineers document out-of-band management IPs, VPN credentials, hypervisor console addresses, and provisioning passwords—the exact credentials that bypass every other security control. The notes field in phpIPAM has effectively become an unofficial secrets repository because it's searchable and persistent. Exposure of "hostname web-server-01" is qualitatively different from exposure of "iLO password stored in notes." The CVSS score treats these as the same vulnerability class.
The 'unauthenticated' framing obscures a critical question: how are these share tokens generated, and how long do they remain valid? If tokens use predictable patterns or long lifespans—as is common in deployments serving contractor access—the practical exploitability far exceeds what the CVSS suggests. You should audit where share URLs appear in your environment (email threads, Slack archives, ticketing systems, documentation) and treat any stale share token as a potential exposure.
The fix (checking that the address belongs to the authorized subnet) is correct, but the deeper issue is whether other share-related endpoints have similar authorization gaps. The entire share API was likely designed under the assumption that token possession equals full access. Audit other share endpoints accordingly.
Actionable priorities: first, determine whether your phpIPAM instance uses cryptographically random share tokens or predictable patterns; second, audit the share token lifespan in your deployment and consider revoking all pre-patch share URLs; third, treat the notes field as potentially compromised and rotate any credentials documented there since the software was installed.