CVE-2026-116845: NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or all with filters, to view out-of-scope device details and create components on them.
Event History
Frequently Asked Questions
Which users are able to exploit this issue?
An attacker must be authenticated and have permission to add components. They can then target device or virtual-machine IDs for parents they would not normally be allowed to view.
What access can an attacker gain through the vulnerable bulk creation workflow?
The attacker can submit arbitrary device or VM IDs, or use _all with filters, to obtain details of out-of-scope devices or virtual machines and create components on those parents.
Which NetBox versions are affected?
NetBox versions from 2.9.0 before 4.7.4 are affected. Upgrading to 4.7.4 or later removes the affected version range.
Is anonymous access sufficient to exploit the vulnerability?
No. Exploitation requires an authenticated user account with add-component permission; the provided information does not indicate that unauthenticated users can exploit it.