CVE-2026-86176: NetBox Information Disclosure Vulnerability

CVE-2026-86176 Overview

CVE-2026-86176 is an information disclosure vulnerability in NetBox versions through 4.7.0. The flaw affects REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. These endpoints fail to scope querysets to the requesting user, returning records belonging to all users. Any authenticated account with standard view permissions can enumerate which objects other users watch or bookmark. The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key and reflects a broken object-level authorization pattern common to multi-tenant Django applications.

Critical Impact
Authenticated users can retrieve private notification, subscription, and bookmark records belonging to other users through unscoped API querysets, exposing internal workflows, monitored assets, and user interest patterns.

Affected Products

NetBox versions up to and including 4.7.0
NetBox REST API endpoints for Notifications, Subscriptions, and Bookmarks
NetBox GraphQL API endpoints for the same object types

Discovery Timeline

2026-09-05 - CVE-2026-86176 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86176

Vulnerability Analysis

NetBox exposes Notifications, Subscriptions, and Bookmarks as user-private records. The API view classes in netbox/extras/api/views.py return the full model queryset instead of filtering by the authenticated user. Any user holding standard view permissions on these models receives records owned by other users when querying the REST or GraphQL endpoints. The disclosed data reveals which devices, circuits, sites, or other NetBox objects a specific user watches or bookmarks. In operational network environments, this reveals monitoring focus, change-management interests, and internal responsibilities across teams.

Root Cause

The root cause is missing per-user scoping in the view layer. Django REST Framework viewsets and GraphQL resolvers for these models rely on model-level permissions but do not override get_queryset to filter by request.user. The referenced code at netbox/extras/api/views.py#L153-L178 and the permission configuration in netbox/netbox/settings.py#L667-L673 show that authorization decisions treat these objects as shared resources rather than user-private data.

Attack Vector

Exploitation requires an authenticated NetBox account with the standard view permissions granted to most operational users. The attacker sends normal GET requests to the affected REST endpoints or issues equivalent GraphQL queries. The response body contains records belonging to all users, including the user foreign-key field that identifies the owner of each notification, subscription, or bookmark. No privilege escalation, brute-force, or object-ID guessing is required because the endpoint returns complete result sets. For the full request patterns and response evidence, see the cross-user disclosure analysis and the VulnCheck advisory for NetBox.

Detection Methods for CVE-2026-86176

Indicators of Compromise

Authenticated API requests to /api/extras/notifications/, /api/extras/subscriptions/, or /api/extras/bookmarks/ returning records with user field values that do not match the requesting account
GraphQL queries referencing notification_list, subscription_list, or bookmark_list root fields from user tokens without administrative scope
Bulk pagination through the affected endpoints from a single token in a short time window

Detection Strategies

Enable NetBox request logging and correlate the authenticated user identity against the user field of returned Notification, Subscription, and Bookmarks objects
Alert on any API response payload from the three affected endpoints that contains more than one distinct user value per response
Baseline normal per-token access volumes to these endpoints and flag deviations

Monitoring Recommendations

Forward NetBox application and reverse-proxy logs to a centralized analytics platform for query-level review
Track NetBox API token issuance and rotate long-lived tokens held by lower-trust integrations
Review audit logs for uncommon GraphQL introspection or schema-enumeration activity preceding data pulls

How to Mitigate CVE-2026-86176

Immediate Actions Required

Upgrade NetBox to a fixed release once published by the NetBox community and track the vendor advisory for exact fixed versions
Restrict access to the NetBox REST and GraphQL APIs to trusted networks and identity-aware proxies while a patch is pending
Revoke or shorten the lifetime of API tokens held by users or integrations that do not require Notification, Subscription, or Bookmarks access

Patch Information

At the time of NVD publication no fixed version is listed in the advisory metadata. Monitor the NetBox Community Repository release notes and the VulnCheck advisory for NetBox for the fixed release. Operators running NetBox 4.7.0 or earlier should treat all versions as affected until an official fix is confirmed.

Workarounds

Apply a downstream patch that overrides get_queryset on the affected viewsets and GraphQL resolvers to filter by request.user
Disable or firewall the GraphQL endpoint if it is not required for business workflows
Limit the permission groups that grant view rights on Notifications, Subscriptions, and Bookmarks to administrative accounts only

bash

# Example nginx snippet to restrict the affected endpoints to trusted CIDRs
location ~ ^/api/extras/(notifications|subscriptions|bookmarks)/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://netbox_upstream;
}

location /graphql/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://netbox_upstream;
}