Medium severity5.4NVD Advisory· Published Nov 3, 2026
CVE-2026-116845
CVE-2026-116845
Description
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or _all with filters, to view out-of-scope device details and create components on them.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: >=2.9.0 <4.7.4
Patches
Vulnerability mechanics
References
6- github.com/netbox-community/netbox/blob/v4.7.3/netbox/netbox/views/generic/bulk_views.pynvd
- github.com/netbox-community/netbox/commit/350ac040cc91359bc0c52066f5df1bc9eba98196nvd
- github.com/netbox-community/netbox/issues/23467nvd
- github.com/netbox-community/netbox/pull/23468nvd
- github.com/netbox-community/netbox/releases/tag/v4.7.4nvd
- www.vulncheck.com/advisories/netbox-from-2.9.0-before-4.7.4-authorization-bypass-via-bulkcomponentcreateviewnvd
News mentions
0No linked articles in our index yet.