CVE-2026-86176: 
Chainguard vulnerability analysis and mitigation

CVE-2026-86176 is an information disclosure vulnerability in NetBox (through version 4.7.0) where the REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks fail to scope querysets to the requesting user. Any authenticated user holding the relevant view permission — or any authenticated user when EXEMPT_VIEW_PERMISSIONS=['*'] is configured — can read all other users' private records, disclosing which users watch or bookmark which objects. The vulnerability was reported on June 13, 2026, and publicly disclosed on September 5, 2026. It carries a CVSS v3.1 score of 4.3 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (Github Advisory, Feedly).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the REST viewsets BookmarkViewSet, NotificationViewSet, and SubscriptionViewSet in netbox/extras/api/views.py (lines 152–178) each define their queryset as Model.objects.all(), applying only model-level permission filtering via RestrictedQuerySet.restrict() with no user=request.user scoping. The GraphQL resolvers for notification_list and subscription_list share the same unscoped BaseObjectType.get_queryset. By contrast, the UI views in netbox/account/views.py correctly filter by request.user. A second trigger exists when EXEMPT_VIEW_PERMISSIONS=['*'] is set (a documented, commonly-used configuration), which allows any authenticated user with zero object permissions to read all records. The researcher confirmed the issue against NetBox 4.6.2 (commit acef3ac) and validated it in-process against a real database (Researcher Advisory, NetBox Source).

Successful exploitation allows any authenticated low-privilege user to enumerate all other users' private Notifications, Subscriptions, and Bookmarks via simple GET requests to the REST API or GraphQL queries. Leaked data includes victim usernames and the object_repr/display field of every object each user has subscribed to, been notified about, or bookmarked — which may include confidential infrastructure names such as site names, device names, IP addresses, or circuit identifiers. The impact is confidentiality-only with no integrity or availability consequences; however, the disclosed information can reveal organizational structure and sensitive asset names that could facilitate targeted attacks or social engineering (Github Advisory, Researcher Advisory).

There is no known public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only a valid authenticated session and the relevant view permission (or a permissive EXEMPT_VIEW_PERMISSIONS configuration), making it trivially executable by any legitimate NetBox user in many deployments (Github Advisory, Feedly).

1. Obtain authentication: Acquire a valid NetBox API token for a low-privilege account that holds extras.view_notification, extras.view_subscription, or extras.view_bookmark permissions — or operate in an environment where EXEMPT_VIEW_PERMISSIONS=['*'] is set, which requires no specific object permissions.
2. Query the REST API for notifications: Send GET /api/extras/notifications/ with the Authorization: Bearer <token> header. The response will include all users' notifications, including their usernames and the names of objects they were notified about.
3. Query the REST API for subscriptions: Send GET /api/extras/subscriptions/ to retrieve all users' subscriptions, disclosing which users are watching which objects.
4. Query the REST API for bookmarks: Send GET /api/extras/bookmarks/ to retrieve all users' bookmarks, including the object_repr field containing potentially sensitive infrastructure names.
5. Query via GraphQL: Alternatively, POST to /graphql/ with the query { notification_list { display user { username } } } to retrieve the same data through the GraphQL interface, including object display names even if the attacker lacks view_user permission.
6. Enumerate and exfiltrate: Paginate through results to collect all records, mapping usernames to the infrastructure objects they monitor, which can be used for reconnaissance or targeted attacks (Researcher Advisory).

• Network: Repeated or automated GET requests to /api/extras/notifications/, /api/extras/subscriptions/, or /api/extras/bookmarks/ from a user account that does not normally access these endpoints; GraphQL POST requests to /graphql/ with queries for notification_list or subscription_list from low-privilege accounts.
• Logs: NetBox access logs showing a single API token making bulk requests to all three private-record endpoints in rapid succession; API requests to these endpoints from accounts that have no legitimate operational need for cross-user data.
• Behavioral: A user account with only view-level permissions (no add/change/delete) making API calls to notification, subscription, or bookmark endpoints and receiving counts greater than 1 (indicating records belonging to other users are being returned).

Update NetBox to a version after 4.7.0 that includes the security fix addressing per-user queryset scoping in the REST and GraphQL APIs. As a workaround prior to patching, restrict the extras.view_notification, extras.view_subscription, and extras.view_bookmark permissions to only trusted administrative accounts, and avoid setting EXEMPT_VIEW_PERMISSIONS=['*'] in production environments. Additionally, implement network-level access controls to limit which users or systems can reach the NetBox API endpoints (Github Advisory, Feedly).