CVE-2026-116845 NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView

NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component permission can submit arbitrary device or VM IDs, or all with...

CVE-2026-116845

NetBox versions 2.9.0 before 4.7.4 are affected by a broken access control vulnerability in the BulkComponentCreateView . This flaw allows authenticated users with add-component permissions to bypass view permissions on parent devices and virtual machines. By submitting arbitrary device or VM IDs...