Live › vulnerability › CVE-2026-116845
NetBox from 2.9.0 before 4.7.4 has a broken access control flaw in BulkComponentCreateView. An authenticated user with add-component permission can submit arbitrary device or VM IDs to view details of devices outside their scope and create components on them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 18:22 UTC. All times on this page are UTC.
NetBox instances from 2.9.0 before 4.7.4 are exposed when users hold add-component permission. The flaw is in the bulk component creation view, so teams that restrict component permissions to trusted staff have less exposure. Instances on 4.7.4 or later are not affected.
No product ranges from the sources yet.
python manage.py version from the NetBox directory or the version shown in the web UI footer.4.7.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.
This page as .md · .json · in your agent: get_signal("CVE-2026-116845")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.