No VulnCrest analysis published for this CVE yet. Below is the original CNA/NVD description, unmodified.
Description
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.
Exploits & detection
No public PoC or detection template found yet.
Timeline
- Published: 03 Nov 2026
- Last modified upstream: 12 Nov 2026
Sources & licenses
- CVE / CVSS / CWE
- NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.
- Exploitation
- CISA KEV (CC0) · EPSS by FIRST.org
- References used for the analysis
- https://github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.py#L1340-L1352
- https://github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196
- https://github.com/netbox-community/netbox/issues/23467
- https://github.com/netbox-community/netbox/pull/23468
- https://github.com/netbox-community/netbox/releases/tag/v4.7.4
- https://www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateview
- https://github.com/netbox-community/netbox/issues/23467
- Analysis, summary and remediation
- © VulnCrest