NetBox EUVD-2026-116109

Requires an authenticated NetBox account (version 2.9.0 up to but not including 4.7.4) that holds a bulk add-component permission such as dcim.add_interface or dcim.add_modulebay but lacks view permission over the targeted parent devices/VMs. The attacker reaches BulkComponentCreateView and submits arbitrary device/VM primary keys in the 'pk' list, or '_all' combined with a GET filter, to act on parents outside their ObjectPermission scope. Limiting factors: exploitation is impossible without a valid account and the add-component permission, and it only matters where NetBox uses constrained ObjectPermissions to scope visibility (multi-tenant/role-separated deployments); it does not grant remote unauthenticated access and availability is unaffected.

This is a moderate, authenticated access-control flaw rather than a top-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium): network-reachable and low-complexity with no user interaction, but PR:L means the attacker must already hold a valid NetBox account carrying add-component permission. Impact is limited - VC:L/VI:L/VA:N - i.e. disclosure of out-of-scope device/VM details and unauthorized component creation, not full system compromise. No CISA KEV listing and no EPSS score are present in the input, so exploitation-probability signals are absent rather than low; treat 'not scored' as missing data, not reassurance. No working public exploit was supplied - the references are the issue, the patch PR/commit, and a release tag, plus a regression test that demonstrates the fixed behavior. The vuln.today decision label is 'this_month', consistent with a real but non-urgent internal authorization bug: prioritize patching within the month, especially in multi-tenant NetBox deployments relying on ObjectPermission scoping, but this is not an act_now/emergency item on the evidence provided.

An authenticated NetBox user who has been granted a bulk add-component permission (e.g. dcim.add_interface) but only scoped view access to some devices posts to the BulkComponentCreateView supplying device/VM primary keys outside their permission scope, or '_all' together with a filter. NetBox discloses those out-of-scope parent objects and creates the requested components on them, bypassing the intended view-permission constraint. No public exploit code exists; PR #23468 includes a regression test illustrating the pre-patch behavior.