Description

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-05T11:16:46.263Z",
  "pubdate": "2026-09-05T11:16:46.263Z",
  "executiveSummary": "NetBox versions through 4.7.0 contain an Insecure Direct Object Reference (IDOR) vulnerability affecting the REST and GraphQL API endpoints.\nThe flaw manifests in the handling of Notifications, Subscriptions, and Bookmarks, where the application fails to properly enforce ownership scoping during query execution.\nAuthenticated users possessing standard 'view' permissions are granted unauthorized access to sensitive, user-private records belonging to other users within the system.\nThis vulnerability exposes metadata regarding user activity, specifically revealing which objects individual users have elected to watch or bookmark, potentially compromising organizational operational security and user privacy.\nThe risk is categorized as significant because it allows any authenticated attacker to perform reconnaissance on user behavior without requiring elevated administrative privileges.\nExploitation requires an active session with basic view permissions, allowing the adversary to systematically iterate through unscoped querysets to aggregate unauthorized data.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of queryset filtering within the NetBox API layer. Specifically, the REST and GraphQL backend components fail to apply an 'owner' or 'user_id' filter to the querysets responsible for fetching Notification, Subscription, and Bookmark objects.\nIn a secure configuration, these endpoints should implicitly scope results to the authenticated Request.user. However, the current implementation utilizes broad querysets that do not validate the relationship between the authenticated session and the requested object ID.\nAttack flow involves an authenticated user interacting with the /api/extras/bookmarks/ or /api/extras/notifications/ endpoints. By issuing a GET request without specific filters, or by manipulating parameters to query object IDs not associated with their own account, an attacker can bypass authorization checks.\nBecause the API backend fails to verify the ownership attribute of the targeted records before returning them in the JSON or GraphQL response, the system effectively ignores user-private boundaries. This allows for the enumeration of private user data across the entire database instance.\nThe vulnerability is consistent across both REST and GraphQL interfaces, indicating a systemic failure in the authorization middleware or the ORM (Object-Relational Mapping) queryset definitions used by the affected components.\nImpact includes the mass exfiltration of sensitive object-subscription metadata. An attacker can map the organizational structure and identify which personnel are monitoring specific infrastructure components, which could be leveraged to inform further social engineering or targeted attacks against NetBox-managed assets.\nNo special privileges beyond 'view' permissions are required, making this an easily exploitable flaw for any user with authenticated access to the NetBox API."
}