CVE-2026-71458

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before Role-Based Access Control (RBAC) is applied. Because the 403 to 404 response shim only rewrites 403 responses, the path for a pk=0 miss returns a different 404 detail string. This difference between "Not found." and "No matches..." allows an attacker to determine if a named resource, such as an organization, credential, inventory, or host, exists anywhere on the platform, enabling cross-tenant internal hostname enumeration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.