CVE-2026-86176 in NetBox
Summary
by MITRE • 09/05/2026
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in NetBox versions up to 4.7.0 represents a critical failure in data isolation mechanisms within the application's API layer. Specifically, the REST and GraphQL endpoints responsible for handling user-specific resources such as Notifications, Subscriptions, and Bookmarks fail to enforce proper scoping based on the authenticated identity of the requesting user. In a correctly secured system, these private records should be strictly filtered so that an individual can only retrieve data associated with their own account. However, due to the use of unscoped querysets in the backend logic, the database queries executed by these endpoints do not include the necessary filters to restrict results to the current user's context. This architectural flaw effectively bypasses the intended access control boundaries, allowing any authenticated session to traverse and retrieve data belonging to other users within the same instance.
From a technical perspective, this issue stems from an improper implementation of object-level permissions in the API serializers or viewsets. When processing requests for notifications, subscriptions, or bookmarks, the application logic retrieves all matching records from the database without applying a filter clause that ties the results to the specific user ID associated with the active authentication token. This lack of scope enforcement means that the query returns a comprehensive list of private items across the entire tenant or organization rather than isolating them per user. The flaw is particularly insidious because it does not require privilege escalation; any account with basic view permissions for these modules can exploit this behavior, turning standard read operations into powerful data aggregation tools against other users' activities and preferences.
The operational impact of this vulnerability is significant in terms of confidentiality and privacy. Attackers who obtain valid credentials for a low-privilege user can enumerate the private bookmarks, subscriptions, and notification histories of all other users on the system. This disclosure reveals sensitive organizational intelligence, including which network devices or IP addresses are being monitored by specific administrators, what configurations they have saved as favorites, and potentially their alerting thresholds based on subscription patterns. Such information is highly valuable for reconnaissance during a cyber attack, allowing adversaries to map out critical infrastructure priorities and identify high-value targets within the IT environment without needing elevated privileges themselves.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in restricting access to resources to authorized users. It also maps closely to MITRE ATT&CK technique T1078 Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized data exfiltration. Furthermore, the ability to gather information about user behavior and monitored assets relates to reconnaissance activities described under T1592 Gather Victim Host Information or T1530 Data from Cloud Storage Object Discovery if applied broadly across cloud-connected records. The exposure of private bookmarks and subscriptions essentially provides a map of an organization's operational focus areas, which can be used to tailor subsequent phishing campaigns or targeted attacks against specific personnel responsible for critical systems.
Mitigation strategies must prioritize immediate patching as the primary defense vector. Administrators running NetBox versions 4.7.0 or earlier should upgrade to the latest patched release where this scoping logic has been corrected in the API backend code. Until an update can be applied, network-level controls such as Web Application Firewalls may offer limited protection by inspecting request parameters for anomalies, though they cannot fully mitigate server-side logic flaws. Additionally, organizations should review their authentication and authorization policies to ensure that least-privilege principles are strictly enforced, minimizing the blast radius if a low-privileged account is compromised. Regular audits of API access logs can also help detect unusual patterns of bulk data retrieval from these endpoints, serving as an early warning indicator for potential exploitation attempts.