{"id":"CVE-2026-83805","title":"Nautobot is a Network Source of Truth and Network Automation Platform","summary":"Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under re…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-285","CWE-639"],"vendor":"nautobot","product":"nautobot","affected":["nautobot >= 3.0.0, < 3.1.8"],"patched":["nautobot 3.1.8"],"published":"2026-09-22","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:12:04.247","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83805","references":[{"url":"https://github.com/nautobot/nautobot/commit/8682707d0391cbfd7694e3276127b78dc9cf29d8","label":"security-advisories@github.com"},{"url":"https://github.com/nautobot/nautobot/releases/tag/v3.1.8","label":"security-advisories@github.com"},{"url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-q4c5-2j6f-r476","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-q4c5-2j6f-r476"}],"tags":["nvd","ghsa","pip","cve.org"],"epss":0.00294,"epssPercentile":0.2227,"aliases":["GHSA-q4c5-2j6f-r476"],"ecosystem":"pip","ingestedAt":"2026-09-22T20:10:15.096Z","slug":"CVE-2026-83805","body":"## Overview\n\nNautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-83805)\n\nAffected packages:\n\n- `nautobot >= 3.0.0, < 3.1.8`\n\nPatched in:\n\n- `nautobot 3.1.8`\n\nSource: https://github.com/advisories/GHSA-q4c5-2j6f-r476","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}