---
id: CVE-2026-86176
title: >-
  NetBox through 4.7.0 fails to properly scope user-private records in REST and
  GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks
summary: >-
  NetBox through 4.7.0 fails to properly scope user-private records in REST and
  GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks.
  Authenticated users with view permissions can access all users' private
  records through …
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: netbox-community
product: netbox
affected:
  - netbox <= 4.7.0
published: '2026-09-05'
updated: '2026-09-18'
sourceUpdated: '2026-09-18T18:17:17.927'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86176'
references:
  - url: >-
      https://github.com/geo-chen/oss/blob/main/netbox.md#finding-1-cross-user-disclosure-of-private-notifications-subscriptions-and-bookmarks-via-rest-api-and-graphql-missing-per-user-scoping
    label: disclosure@vulncheck.com
  - url: 'https://github.com/netbox-community/netbox'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/extras/api/views.py#L153-L178
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/netbox-community/netbox/blob/v4.7.0/netbox/netbox/settings.py#L667-L673
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/netbox-through-4.7.0-information-disclosure-via-rest-and-graphql-apis
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00199
epssPercentile: 0.10058
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T17:06:47.622473Z'
ingestedAt: '2026-09-06T07:51:56.581Z'
---

## Overview

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.