PT-2026-136326
CVE-2026-116845
·
تاريخ النشر
2026-11-03
·
تاريخ التحديث
2026-11-03
الوصف من
CVSS 3.1
5.4
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or all with filters, to view out-of-scope device details and create components on them.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾