CVE-2026-116845Medium· 5.4▾ TwilightPoC availableNetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component perm…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.
netbox >= 2.9.0 < 4.7.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86175Medium· 6.5NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses
CVE-2026-104073High· 7.6NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the…
CVE-2026-86176Medium· 4.3NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks
CVE-2025-69848Medium· 5.4NetBox is an open-source infrastructure resource modeling and IP address management platform
CVE-2026-55251Medium· 6.5NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox
CVE-2026-54752Critical· 9.6NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox