SB2026101468 - Improper Authorization in Nautobot

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper authorization in Nautobot's REST API cable trace and path endpoints when traversing cable paths and serializing objects without enforcing their object-level view permissions. A remote user can send a GET request to a trace or paths endpoint for an object they are permitted to view to disclose sensitive information.

Exposure occurs only in deployments that use constrained ObjectPermission rules to limit view access to cable terminations, cables, or their parent devices. Disclosed information is limited to objects along the cable path from the requested object; unrelated objects cannot be arbitrarily enumerated. The corresponding UI cable trace view is not affected.

Remediation

Install update from vendor's website.

References

• https://github.com/nautobot/nautobot/security/advisories/GHSA-m6h7-g92h-9p44
• https://github.com/nautobot/nautobot/commit/3bca201bf8a7f33be1cf792110e46e720bfaf38c