CVE-2026-44794

Published: May 28, 2026Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.5

Source: security-advisories@github.com (Secondary)

Description

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different "content types" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user "view" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2.

Affected (2)

Products: Networktocode: Nautobot

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Networktocode Nautobot	Before 2.4.33
Networktocode Nautobot	From 3.0.0 to 3.1.2

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (5)

https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b

Source: security-advisories@github.com

Patch

https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1

Source: security-advisories@github.com

Patch

https://github.com/nautobot/nautobot/releases/tag/v2.4.33

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/nautobot/nautobot/releases/tag/v3.1.2

Source: security-advisories@github.com

ProductRelease Notes

https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.