{"action":"Upgrade openwisp-ipam to 1.2.1 or later.","affected":[{"fixed":"1.2.1","introduced":"0"}],"component":"openwisp-ipam","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.2.1"],"ghsa_id":"GHSA-x287-5c68-36wp","id":"tcs_01M5KG36CEQTY1CCD3MBE4WBCS","modified_at":"2026-08-26T14:45:10.393164484Z","published_at":"2026-08-26T14:38:10Z","references":["https://osv.dev/vulnerability/GHSA-x287-5c68-36wp","https://github.com/openwisp/openwisp-ipam/security/advisories/GHSA-x287-5c68-36wp","https://github.com/openwisp/openwisp-ipam/pull/220","https://github.com/openwisp/openwisp-ipam/commit/04a2ef949498c6591f9ac35713d7451fb9f75362","https://github.com/openwisp/openwisp-ipam/commit/a4b272461bfa7a1762baf0b1fd76b4f5b681586b","https://github.com/openwisp/openwisp-ipam","https://github.com/openwisp/openwisp-ipam/releases/tag/1.2.1"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-x287-5c68-36wp","url":"https://osv.dev/vulnerability/GHSA-x287-5c68-36wp"}],"summary":"OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses"}