Improper Authorization in Nautobot - #VU162764
Published: November 9, 2026
Vulnerability identifier: #VU162764
CSH Severity: Low
CVSS v4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged remote attacker to make Nautobot jobs act on objects they cannot view and discover their existence.
The vulnerability exists due to missing object view permission checks when Job and JobButtonReceiver execution paths resolve user-supplied object inputs. A low-privileged remote attacker with permission to run the target job can submit a crafted web form or REST API request containing an unauthorized object's ID to pass that object to the job.
Affected software
Nautobot
Remediation
Install security update from vendor's website.
Nautobot - addressed in versions 2.4.45, 3.2.8