PT-2026-136326
CVE-2026-116845
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 3.1
5.4
MediumMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or all with filters, to view out-of-scope device details and create components on them.
Found an issue in the description? Have something to add? Feel free to write us 👾