CVE-2026-86176: Authorization Bypass Through User-Controlled Key in netbox-community netbox
Description
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
CVSS v3.1
Score 4.3medium
Affected software
netbox-community
netbox
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86176 describes an authorization bypass in netbox-community's NetBox product through version 4.7.0. The vulnerability arises from improper scoping of user-private records in REST and GraphQL API endpoints related to Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can query unscoped datasets, thereby accessing private records of other users. This leads to information disclosure about user interactions such as which users watch or bookmark certain objects.
Potential Impact
The vulnerability allows authenticated users with view permissions to access private data of other users, specifically their Notifications, Subscriptions, and Bookmarks. This results in limited confidentiality impact by disclosing user-specific preferences and activities. There is no impact on integrity or availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict view permissions to trusted users only to minimize exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-05T10:40:40.966Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a9bf7fdacd9273b49bf721c
Added to database: 09/05/2026, 11:07:41 UTC
Last enriched: 09/26/2026, 03:25:52 UTC
Last updated: 10/20/2026, 18:48:24 UTC
Views: 91
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.