Read the docs
TI-2026-84457 Aliases CVE-2026-116845GHSA-5rfv-8fqh-fwgx

Broken access control in NetBox bulk component creation

Priority MEDIUM 57CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

NetBox from 2.9.0 before 4.7.4 is affected. Its BulkComponentCreateView fails to enforce view permissions on parent devices and virtual machines, which is broken access control (CWE-863). An authenticated user with the add-component permission can submit arbitrary device or VM IDs, or use filters, to view details of out-of-scope devices and create components on them.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00355 29th percentileScored 2026-11-07
Fix Fixed netbox (netbox-community): 4.7.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
netbox-communitynetbox2.9.0 to before 4.7.44.7.4Patch availableCNA
  • netbox Vendornetbox-community Affected 2.9.0 to before 4.7.4 Fixed in 4.7.4 Patch available CNA

Remediation

Upgrade NetBox to version 4.7.4, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA netbox (netbox-community) Fixed in 4.7.4

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-116845
  2. 2026-11-03 Alias added: GHSA-5rfv-8fqh-fwgx
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: LOW → MEDIUM
  5. 2026-11-04 Affected versions changed · Red Hat
  6. 2026-11-04 CVSS score added · Red Hat

References

Patch 2

Other 3

  • TI-2026-39558 Deserialization of untrusted data in netbox-community devicetype-library CVSS 3.1CRITICAL 9.6
  • TI-2026-23330 NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin CVSS 4.0HIGH 8.7
  • TI-2026-39924 Code injection in netbox-community devicetype-library CVSS 3.1MEDIUM 6.5
  • TI-2026-58964 NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs CVSS 4.0HIGH 7.1
  • TI-2026-39685 Uncontrolled search path in netbox-community devicetype-library CVSS 3.1HIGH 8.8
  • TI-2026-68595 Template injection in NetBox custom links leaks session cookies CVSS 4.0MEDIUM 6.9
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences