{"id":"CVE-2026-116845","kind":"vulnerability","aliases":["CVE-2026-116845"],"related":[],"title":"NetBox: broken access control lets users create components on out-of-scope devices","description":"NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.","summary":"NetBox from 2.9.0 before 4.7.4 has a broken access control flaw in BulkComponentCreateView. An authenticated user with add-component permission can submit arbitrary device or VM IDs to view details of devices outside their scope and create components on them.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["netbox","package","self-hosted"],"not_affected_if":["no-component-add-permission","version-4.7.4-or-later"],"how_to_check":"- Check the installed NetBox version, for example with `python manage.py version` from the NetBox directory or the version shown in the web UI footer.\n- Review which accounts hold add-component permissions on devices and virtual machines.","fix":"- NetBox: upgrade to `4.7.4` or later.","status":"open","published_at":"2026-11-03T18:17:54+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","triaged_at":"2026-11-03T18:22:41+00:00","updated_at":"2026-11-03T18:22:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T18:22:41Z","model":"claude-haiku-5-5","output":{"fix":"- NetBox: upgrade to `4.7.4` or later.","reach":"network","title":"NetBox: broken access control lets users create components on out-of-scope devices","impact":"medium","summary":"NetBox from 2.9.0 before 4.7.4 has a broken access control flaw in BulkComponentCreateView. An authenticated user with add-component permission can submit arbitrary device or VM IDs to view details of devices outside their scope and create components on them.","audience":"businesses","category":"package","nicknames":[],"who_cares":["netbox","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users view and modify devices outside their scope","analyst_note":"","how_to_check":"- Check the installed NetBox version, for example with `python manage.py version` from the NetBox directory or the version shown in the web UI footer.\n- Review which accounts hold add-component permissions on devices and virtual machines.","plain_action":"","needs_analyst":false,"not_affected_if":["version-4.7.4-or-later","no-component-add-permission"],"who_is_affected":"NetBox instances from 2.9.0 before 4.7.4 are exposed when users hold add-component permission. The flaw is in the bulk component creation view, so teams that restrict component permissions to trusted staff have less exposure. Instances on 4.7.4 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4203,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116845':17A,20A '-2026':16A,19A '2.9.0':28B,67C '4.7.4':30B,69C 'access':3A,34B,73C 'add':44B,95C 'add-compon':43B,94C 'allow':79C 'arbitrari':49B,100C 'attack':92C 'authent':40B,80C 'broken':2A,33B,72C 'bulkcomponentcreateview':38B,77C 'bypass':83C 'compon':8A,45B,64B,96C,119C 'contain':70C 'control':4A,35B,74C 'creat':7A,63B,118C 'cve':15A,18A 'detail':56B,116C 'devic':14A,50B,58B,88C,101C,115C 'filter':108C 'flaw':36B 'host':25B 'id':53B,104C 'let':5A 'machin':91C 'netbox':1A,21B,26B,65C 'out-of-scop':10A,111C 'outsid':59B 'packag':22B 'parent':87C 'permiss':46B,85C,97C 'scope':13A,61B,114C 'self':24B 'self-host':23B 'submit':48B,99C 'user':6A,41B,81C 'view':55B,84C,110C 'virtual':90C 'vm':52B,103C 'vulner':75C","nicknames":[],"mitigations":[],"who_affected":"NetBox instances from 2.9.0 before 4.7.4 are exposed when users hold add-component permission. The flaw is in the bulk component creation view, so teams that restrict component permissions to trusted staff have less exposure. Instances on 4.7.4 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","netbox","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T18:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116845","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116845","severity":null,"published_at":"2026-11-03T18:17:54+00:00","modified_at":"2026-11-03T18:17:54+00:00","first_seen_at":"2026-11-03T18:22:10+00:00","fetched_at":"2026-11-03T18:22:10+00:00","note":null}],"documents":[{"id":59639,"url":"https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59640,"url":"https://github.com/netbox-community/netbox/releases/tag/v4.7.4","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":59641,"url":"https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}