Description
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
Published: 2026-09-05
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 05 Sep 2026 11:15:00 +0000

Type Values Removed Values Added
Description NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
Title NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
First Time appeared Netbox
Netbox netbox
Weaknesses CWE-639
CPEs cpe:2.3:a:netbox:netbox:*:*:*:*:*:*:*:*
Vendors & Products Netbox
Netbox netbox
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Netbox Netbox
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-05T11:01:27.414Z

Reserved: 2026-09-05T10:40:40.966Z

Link: CVE-2026-86176

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-05T11:16:46.263

Modified: 2026-09-05T11:16:46.263

Link: CVE-2026-86176

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key