NetBox CVE-2026-86176

Exploitation requires a valid NetBox account with at minimum view permissions on one of the affected object types: Notifications, Subscriptions, or Bookmarks. No elevated or administrative privileges are needed. The flaw exists in the default API configuration - no special deployment mode, non-default feature flag, or unusual configuration is required to trigger it. Unauthenticated access is not sufficient; an active session token or API key for a legitimate account is necessary. The key limiting factor is that exploitation is restricted to authenticated insiders, contractors, or anyone who has obtained a valid NetBox credential, and the disclosed information is limited to user-activity metadata (watch/bookmark relationships) rather than the content of infrastructure objects themselves.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) and score of 5.3 are proportionate: the flaw is network-exploitable with low complexity but bounded to authenticated users and limited to confidentiality of user-activity metadata. The 'Authentication Bypass' tag is a mislabel - exploitation requires a valid account (PR:L), and the actual weakness is authorization scoping, not authentication circumvention. A publicly available PoC (geo-chen on GitHub) lowers the exploitation bar for any authenticated insider or contractor, making this a realistic internal threat even if EPSS data is not provided and KEV status is unconfirmed. Even a mid-sized municipal IT team in radom running a shared NetBox instance across departments should treat this as meaningful, since leaked watch/bookmark patterns can reveal which sensitive infrastructure objects staff are actively monitoring. The flaw is automatable (AC:L, UI:N), but the insider-only constraint limits blast radius. No integrity or availability impact is present.

An authenticated low-privileged NetBox user - such as a contractor with standard view access - queries the REST API endpoint for Bookmarks or Subscriptions without any user filter; the server returns records belonging to all users, not just the requester. The attacker iterates the results to learn which colleagues are watching specific network devices, prefixes, or IP blocks, revealing sensitive operational priorities or change activity. A PoC at https://github.com/geo-chen/oss/blob/main/netbox.md#finding-1-cross-user-disclosure-of-private-notifications-subscriptions-and-bookmarks-via-rest-api-and-graphql-missing-per-user-scoping documents the steps against a default 4.7.0 instance.