CVE-2026-86176CWE-639

CVE-2026-86176

Medium · published September 5, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
26.5
In the wild
Unconfirmed
What it is

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00342 · 26.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-05T15:16Z
References (5)
https://github.com/geo-chen/oss/blob/main/netbox.md#finding-1-cross-user-disclosure-of-private-notifications-subscriptions-and-bookmarks-via-rest-api-and-graphql-missing-per-user-scoping · [email protected]https://github.com/netbox-community/netbox · [email protected]https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/extras/api/views.py#L153-L178 · [email protected]https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/netbox/settings.py#L667-L673 · [email protected]https://www.vulncheck.com/advisories/netbox-through-4.7.0-information-disclosure-via-rest-and-graphql-apis · [email protected]
EPSS history
Timeline
  • 07 SEP 03:36Z
    EPSS moved — → 0%
    epss
  • 05 SEP 11:01Z
    NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
    cvelistv5