django-owm-legacy (1.1.0), openwisp-controller (>=1.0.0, <=1.1.2) +2 more potentially affected by unknown CVE via openwisp-ipam (>=1.0.0, <=1.1.1)

openwisp-ipam PYPI version =1.0.0, =1.0.0, =1.1.0, =1.1.0, =1.1.3 Source cves: unknown CVE Source advisory: OSV:GHSA-X287-5C68-36WP...

GHSA-X287-5C68-36WP OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

django-owm-legacy (1.1.0), openwisp-controller (>=1.0.0, <=1.1.2) +2 more potentially affected by unknown CVE via openwisp-ipam (>=1.0.0, <=1.1.1)

openwisp-ipam PYPI version =1.0.0, =1.0.0, =1.1.0, =1.1.0, =1.1.3 Source cves: unknown CVE Source advisory: GHSA-X287-5C68-36WP...

django-owm-legacy (1.1.0), openwisp-controller (>=1.0.0, <=1.1.2) +2 more potentially affected by unknown CVE via openwisp-ipam (>=1.0.0, <=1.1.1)

openwisp-ipam PYPI version =1.0.0, =1.0.0, =1.1.0, =1.1.0, =1.1.3 Source cves: unknown CVE Source advisory: SNYK:PYTHON-OPENWISPIPAM-19427353...

Missing Authorization

Overview openwisp-ipam is an IP address space administration module of OpenWISP. Affected versions of this package are vulnerable to Missing Authorization via the ExportSubnetView process. An attacker can access sensitive information belonging to other organizations by submitting an export reques...

OpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

PT-2026-86431

Summary OpenWISP IPAM is multi-tenant: every Subnet belongs to an organization, and API access is scoped to the organizations a user belongs to. The CSV export endpoint, ExportSubnetView, omits the organization-membership check that its import sibling performs, and loads the subnet by primary key...

django-allauth-d120 (0.0.3), meine-stadt-transparent (0.2.4) +6 more potentially affected by CVE-2026-27982 via django-allauth (0.41.0)

django-allauth PYPI version 0.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - django-allauth-d120 0.0.3 - meine-stadt-transparent 0.2.4 - oms-cms 0.9.9 - openwisp-ipam 0.1.0 - openwisp-network-topology =0.3.0,...

django-allauth-d120 (0.0.3), meine-stadt-transparent (0.2.4) +6 more potentially affected by CVE-2025-65431 via django-allauth (0.41.0)

django-allauth PYPI version 0.41.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - django-allauth-d120 0.0.3 - meine-stadt-transparent 0.2.4 - oms-cms 0.9.9 - openwisp-ipam 0.1.0 - openwisp-network-topology =0.3.0,...