Executive brief
NetBox, an open-source network automation platform used by organizations to manage network infrastructure, fails to properly restrict access to private user data in its REST and GraphQL APIs. Authenticated users can view private records (such as notifications, subscriptions, and bookmarks) belonging to other users, potentially revealing sensitive information about which network objects or configurations other team members are monitoring or tracking.
Technical details
NetBox through version 4.7.0 contains an access control vulnerability in its REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. The vulnerability arises from unscoped querysets that fail to filter user-private records based on ownership. An authenticated attacker with view permissions can craft API requests to enumerate and access other users' private records, disclosing which users are watching or bookmarking specific objects. The vulnerability requires authentication and network access to the API endpoints. No indication of public patches is mentioned in the advisory.
Affected products
- NetBox Community NetBox through 4.7.0
Timeline
- 2026-09-05: disclosed