Vulnerability · Published Sep 5, 2026 · Assigned by VulnCheck
CVE-2026-86176NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
Medium 4.3
In plain English
A medium-severity authorization bypass via user-controlled key in netbox from netbox-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 72.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| netbox-community | netbox | 0 – through 4.7.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- Researcher Advisory third-party-advisory, exploit
- Bookmark, Notification and Subscription viewsets technical-description
- EXEMPT_EXCLUDE_MODELS technical-description
- https://github.com/netbox-community/netbox product
- VulnCheck Advisory: NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs third-party-advisory