CVE-2026-83805Medium· 6.4▾ SunlitNautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under re…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
nautobot >= 3.0.0, < 3.1.8Patched in:
nautobot 3.1.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-83801Medium· 5.4Nautobot is a Network Source of Truth and Network Automation Platform
CVE-2024-23345High· 7.1XSS potential in rendered Markdown fields (comments, description, notes, etc.)
CVE-2023-46128High· 7.7Nautobot vulnerable to exposure of hashed user passwords via REST API
CVE-2023-50263Low· 3.7Unauthenticated db-file-storage views
CVE-2026-34203Low· 2.7Nautobot: Management of users via REST API does not apply configured password validators
CVE-2026-44794Medium· 5.4Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference