CVE-2026-69117

Name of the Vulnerable Software and Affected Versions NetBox version 4.5.8

Description An ORM injection exists that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django ORM lookup expressions into nested object references. This is achieved by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. By exploiting the unrestricted queryset used by WritableNestedSerializer, attackers can perform boolean-based blind data extraction of sensitive field values and bypass object-level permissions across several application modules, including dcim, ipam, tenancy, virtualization, circuits, and extras. ORM injection is a technique where an attacker manipulates the database queries generated by an Object-Relational Mapper (ORM) to access or modify unauthorized data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.