https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:17:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44794 <p><strong>Affected:</strong> nautobot</p> <p>Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different &#34;content types&#34; or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot&#39;s REST API failed to enforce user &#34;view&#34; permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.</p> <p><strong>Affected:</strong> nautobot</p> <p>Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different &#34;content types&#34; or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot&#39;s REST API failed to enforce user &#34;view&#34; permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.</p> https://cve.radiocsirt.org/vuln/cve-2026-44794 https://cve.radiocsirt.org/vuln/ghsa-wpxj-44w3-2j6x <p><strong>Affected:</strong> PyPI: nautobot</p> <p>### Impact</p> <p>In the case of inter-object references via `GenericForeignKey` (a pattern allowing an object to reference another object that may belong to one of several different &#34;content types&#34; or database tables), when creating or updating an object containing a `GenericForeignKey`, Nautobot&#39;s REST API failed to enforce user &#34;view&#34; permissions when determining whether a given reference to another object would be valid.</p> <p>As a concrete example, a user:</p> <p>- who has permission to create or update `ImageAttachment` records - but who lacks permission to view (some or all) `Device` records - _but who knows (via some other mechanism) the UUID of a specific `Device` that they do not otherwise have access to_</p> <p>could create via the REST API an `ImageAttachment` linked to that specific `Device`.</p> <p>Other models that use `GenericForeignKey` and may be writable via the REST API, and hence have a similar vulnerability to `ImageAttachment`, may include:</p> <p>- `ApprovalWorkflow` - `Cable` - `ConfigContext` - `ContactAssociation` - `DataCompliance` - `Device` - `ExportTemplate` - `GraphQLQuery` - `Note` - `ObjectMetadata` - `RelationshipAssociation` - `StaticGroupAssociation` - `VirtualMachine`</p> <p>Additionally, any Nautobot Apps that provide models with a REST API and use GenericForeignKey may have a similar vulnerability for their models.</p> <p>### Patches</p> <p>A general-purpose fix has been implemented in Nautobot 2.4.33 and 3.1.2, which ensures correct application of &#34;view&#34; permissions when creating or mo…</p> <p><strong>Affected:</strong> PyPI: nautobot</p> <p>### Impact</p> <p>In the case of inter-object references via `GenericForeignKey` (a pattern allowing an object to reference another object that may belong to one of several different &#34;content types&#34; or database tables), when creating or updating an object containing a `GenericForeignKey`, Nautobot&#39;s REST API failed to enforce user &#34;view&#34; permissions when determining whether a given reference to another object would be valid.</p> <p>As a concrete example, a user:</p> <p>- who has permission to create or update `ImageAttachment` records - but who lacks permission to view (some or all) `Device` records - _but who knows (via some other mechanism) the UUID of a specific `Device` that they do not otherwise have access to_</p> <p>could create via the REST API an `ImageAttachment` linked to that specific `Device`.</p> <p>Other models that use `GenericForeignKey` and may be writable via the REST API, and hence have a similar vulnerability to `ImageAttachment`, may include:</p> <p>- `ApprovalWorkflow` - `Cable` - `ConfigContext` - `ContactAssociation` - `DataCompliance` - `Device` - `ExportTemplate` - `GraphQLQuery` - `Note` - `ObjectMetadata` - `RelationshipAssociation` - `StaticGroupAssociation` - `VirtualMachine`</p> <p>Additionally, any Nautobot Apps that provide models with a REST API and use GenericForeignKey may have a similar vulnerability for their models.</p> <p>### Patches</p> <p>A general-purpose fix has been implemented in Nautobot 2.4.33 and 3.1.2, which ensures correct application of &#34;view&#34; permissions when creating or mo…</p> https://cve.radiocsirt.org/vuln/ghsa-wpxj-44w3-2j6x