Improper Authorization in Nautobot - #VU162767
Published: November 9, 2026
Vulnerability identifier: #VU162767
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-285
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged attacker to link newly created Nautobot objects to related objects outside their viewing permissions and infer their existence.
The vulnerability exists due to missing view-permission checks on related objects referenced during CSV imports through the Import Objects job. A low-privileged attacker can submit an import with permission to create the target object type and run that job, establishing unauthorized relationships and learning whether referenced objects exist.
Affected software
Nautobot
Remediation
Install security update from vendor's website.
Nautobot - addressed in versions 2.4.45, 3.2.8