CVE-2026-83805

Name of the Vulnerable Software and Affected Versions Nautobot versions 3.0.0 through 3.1.7

Description An authorization bypass exists in the generic ApprovalWorkflowStageResponse create endpoint. This endpoint fails to enforce approver-group membership, the change permission on the object under review, and the restriction of one response per user. A user possessing only the extras.add approvalworkflowstageresponse permission can submit approved responses directly. Furthermore, the writable user and state variables allow responses to be attributed to arbitrary users. These forged responses can satisfy the min approvers requirement, approving the workflow and activating a gated ScheduledJob without a legitimate approver, leading to unauthorized server-side job execution.

Recommendations Update to version 3.1.8. Restrict the extras.add approvalworkflowstageresponse permission to ensure no untrusted users hold it, as approval responses should only be created via the stage approve and deny actions.