{"id":"CVE-2026-116845","published":"2026-11-03T18:17:54.530","lastModified":"2026-11-03T20:18:11.670","description":"NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352","tags":[]},{"url":"https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196","tags":[]},{"url":"https://github.com/netbox-community/netbox/issues/23467","tags":[]},{"url":"https://github.com/netbox-community/netbox/pull/23468","tags":[]},{"url":"https://github.com/netbox-community/netbox/releases/tag/v4.7.4","tags":[]},{"url":"https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview","tags":[]},{"url":"https://github.com/netbox-community/netbox/issues/23467","tags":[]}],"exploitRefs":[{"url":"https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352","tags":[]},{"url":"https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196","tags":[]},{"url":"https://github.com/netbox-community/netbox/issues/23467","tags":[]},{"url":"https://github.com/netbox-community/netbox/pull/23468","tags":[]},{"url":"https://github.com/netbox-community/netbox/releases/tag/v4.7.4","tags":[]},{"url":"https://github.com/netbox-community/netbox/issues/23467","tags":[]}],"hasPoc":true,"ai":null}