CVE-2026-116845

Description

NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.

References

• https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352
• https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196
• https://github.com/netbox-community/netbox/issues/23467
• https://github.com/netbox-community/netbox/pull/23468
• https://github.com/netbox-community/netbox/releases/tag/v4.7.4