Medium severity · published Sep 5, 2026
CVE-2026-86176
NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NE
netbox · netbox-community
through 4.7.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86176
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86176
github.com
https://github.com/geo-chen/oss/blob/main/netbox.md#finding-1-cross-user-disclosure-of-private-notifications-subscriptions-and-bookmarks-via-rest-api-and-graphql-missing-per-user-scoping
github.com
https://github.com/netbox-community/netbox
github.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/extras/api/views.py#L153-L178
github.com
https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/netbox/settings.py#L667-L673
www.vulncheck.com
https://www.vulncheck.com/advisories/netbox-through-4.7.0-information-disclosure-via-rest-and-graphql-apis
More from netbox
8.8
CVE-2026-29514
NetBox 4.3.5 - 4.5.4 RCE via RenderTemplateMixin
7.6
CVE-2026-104073
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
6.5
CVE-2026-86175
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs