CVE-2026-86176
NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 5, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 5, 2026
Description
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
- CWE-639 Authorization Bypass Through User-Controlled Key
Affected Products
| Product | Versions |
|---|---|
netboxnetbox-community |
|
References
- Researcher Advisorythird-party-advisoryexploit
- Bookmark, Notification and Subscription viewsetstechnical-description
- EXEMPT_EXCLUDE_MODELStechnical-description
- https://github.com/netbox-community/netboxproduct
- VulnCheck Advisory: NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.