CVE-2026-86176: NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
Affected Software
Event History
Frequently Asked Questions
Who can access the exposed records?
Authenticated NetBox users who have view permissions can access private Notification, Subscription, and Bookmark records belonging to other users through the REST and GraphQL APIs.
What information is disclosed?
The issue can reveal which users have notifications, subscriptions, or bookmarks associated with particular objects. The provided data describes information disclosure only; it does not indicate modification or deletion of those records.
Which NetBox versions are affected?
NetBox through version 4.7.0 is affected.