GHSA-X287-5C68-36WP: Broken Object-Level Authorization in OpenWISP IPAM Django Admin
Vulnerability ID: GHSA-X287-5C68-36WP
CVSS Score: 7.1
Published: 2026-08-26
A broken object-level authorization (BOLA) vulnerability exists in the Django Admin custom export view of OpenWISP IPAM. This flaw allows a multi-tenancy restricted staff user to export subnets and associated IP addresses belonging to different organizations by supplying a targeted subnet identifier in the export request.
TL;DR
An authenticated staff user can bypass multi-tenancy access controls in OpenWISP IPAM to export IP allocation tables of other organizations by targeting the custom subnet export view with a specific identifier.
Technical Details
- CWE ID: CWE-639
- Attack Vector: Network
- CVSS Score: 7.1 (High)
- Exploit Status: Proof-of-Concept
- KEV Status: Not Listed
- Impact: Information Disclosure
Affected Systems
- OpenWISP IPAM (openwisp-ipam)
-
openwisp-ipam: < 1.2.1 (Fixed in:
1.2.1)
Code Analysis
Commit: 04a2ef9
Fix: BOLA on Subnet Export Django Admin View
Commit: a4b2724
Add regression test for multi-tenant subnet export
Mitigation Strategies
- Upgrade openwisp-ipam to version 1.2.1 or newer.
- Enforce explicit queryset-level multitenancy restrictions on custom administrative views.
- Apply manual hotfix using get_object_or_404 against the filtered queryset.
Remediation Steps:
- Locate the openwisp_ipam/admin.py file in the python environment.
- Import get_object_or_404 from django.shortcuts if not already present.
- Modify the export_view function to retrieve the subnet through self.get_queryset(request) using get_object_or_404.
- Restart the OpenWISP web service to apply the updates.
References
Read the full report for GHSA-X287-5C68-36WP on our website for more details including interactive diagrams and full exploit analysis.
