openwisp-ipam

Version	Released
`1.3.1` patch	Sep 03, 2026
`1.3` minor	Sep 03, 2026
`1.2.1` minor	Jun 15, 2026
`1.2.post1` pre 1 CVE	Oct 24, 2025
`1.1.1` patch 1 CVE	Jan 31, 2025
`1.1` minor 1 CVE	Nov 21, 2024
`1.0` major 1 CVE	Apr 28, 2022
`0.2` minor 1 CVE	Oct 16, 2020
`0.1.1` patch 1 CVE	Sep 04, 2020
`0.1` initial 1 CVE	May 28, 2020

1.3.1 patch

Sep 03, 2026

1.3 minor

Sep 03, 2026

1.2.1 minor

Jun 15, 2026

1.2.post1 pre

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

Oct 24, 2025

1.1.1 patch

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

Jan 31, 2025

1.1 minor

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

Nov 21, 2024

1.0 major

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

Apr 28, 2022

0.2 minor

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

Oct 16, 2020

0.1.1 patch

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

Sep 04, 2020

0.1 initial

1 CVE

GHSA-x287-5c68-36wp Aug 26, 2026

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key with no organization filter. An authenticated user who is a member of one organization can therefore export a subnet belonging to another organization — its name, CIDR, organization slug and every IP address in it — by issuing an export request for that subnet's id.

Details

ImportSubnetView.post() authorizes first, by calling assert_organization_permissions():

# openwisp_ipam/api/views.py  (ImportSubnetView)
def post(self, request, *args, **kwargs):
    self.assert_organization_permissions(request)        # <-- org-membership check
    file = request.FILES["csvfile"]
    ...
    self.subnet_model().import_csv(file)

# openwisp_ipam/api/utils.py:16  (AuthorizeCSVImport)
def assert_organization_permissions(self, request):
    if request.user.is_superuser:
        return
    # ... otherwise verifies the user belongs to the target organization

ExportSubnetView.post() performs no such check. It is declared with IpAddressOrgMixin (whose organization scoping lives in get_queryset()), but its overridden post() never calls get_queryset() or assert_organization_permissions() — it goes straight to export_csv():

# openwisp_ipam/api/views.py:246
class ExportSubnetView(ProtectedAPIMixin, IpAddressOrgMixin, CreateAPIView):
    subnet_model = Subnet
    def post(self, request, *args, **kwargs):
        response = HttpResponse(content_type="text/csv")
        response["Content-Disposition"] = 'attachment; filename="ip_address.csv"'
        writer = csv.writer(response)
        self.subnet_model().export_csv(kwargs["subnet_id"], writer)   # no org check reached
        return response

export_csv() resolves the subnet by primary key with no organization filter and writes its full contents:

# openwisp_ipam/base/models.py:242
def export_csv(self, subnet_id, writer):
    ipaddress_model = load_model("openwisp_ipam", "IpAddress")
    subnet = load_model("openwisp_ipam", "Subnet").objects.get(pk=subnet_id)   # any org's subnet
    # ... writes subnet name, CIDR, organization slug, and every IpAddress (address, description, …)

The subnet_id is a random UUIDField (migrations/0001_initial.py: models.UUIDField(default=uuid.uuid4)), so an attacker must obtain the target subnet's id rather than enumerate it — hence Attack Complexity: High. This is a genuine missing-authorization flaw regardless: the import/export asymmetry shows the check was intended, and subnet ids routinely appear in URLs, logs, shared CSV exports and support tickets, from which a cross-organization id can leak.

The same single-object pattern (resolving the subnet by subnet_id outside the org-scoped queryset) also appears in AvailableIpView.get() and RequestIPView.post() (the latter additionally writes an IP into the target subnet); these are worth reviewing alongside the export fix.

Proof of concept

Prerequisites: an OpenWISP IPAM instance with two organizations OrgA and OrgB; a normal (non-superuser) user who is a member of OrgB only; a subnet in OrgA whose id S is known to the attacker (e.g. leaked via a URL/log/shared export).

As the OrgB user, authenticate to the API.
POST /api/v1/subnet/{S}/export/ (OrgA's subnet id).
Result: a CSV download containing OrgA's subnet name, CIDR, organization slug and every IP address in it — even though the user belongs only to OrgB.
Control (proves it's an oversight): the corresponding import endpoint POST /api/v1/import-subnet/ with OrgA data is rejected for the same user by assert_organization_permissions().

(Reported from a first-hand source review of the current master: the missing check in ExportSubnetView.post, the guarded ImportSubnetView.post sibling, the un-filtered Subnet.objects.get(pk=…) in export_csv, and the UUIDField primary key were each verified by hand. The fix is a one-line authorization call, so a maintainer can confirm trivially with two organizations.)

Impact

A member of one organization can read the complete contents of another organization's subnet — its IP allocation inventory (addresses, descriptions, organization slug, CIDR). In a WISP / network-management deployment this discloses another tenant's network topology and host inventory. Exploitation requires obtaining the target subnet's UUID (AC:H), but the authorization check is missing outright. (RequestIPView shares the pattern and additionally allows writing an IP into another organization's subnet — a separate integrity concern for the maintainer to confirm.)

Remediation

Add the organization-membership check to ExportSubnetView.post() — call self.assert_organization_permissions(request) (as ImportSubnetView does), or resolve the subnet through the org-scoped get_queryset() / get_object() and return 404 when it isn't in the caller's organizations. Apply the same to AvailableIpView and RequestIPView.

Affected versions

0.1


          0.1.1

0.2

1.0

1.1


          1.1.1


          1.2.post1

Fixed in


          1.2.1

References

Updated Aug 26, 2026 · Source: OSV.dev

May 28, 2020

Activity

Reach

Details