2 matches found
Nautobot missing object-level permissions enforcement when running Job Buttons
Impact When submitting a Job to run via a Job Button, only the model-level extras.runjob permission is checked i.e., does the user have permission to run Jobs in general?. Object-level permissions i.e., does the user have permission to run this specific Job? are not enforced by the URL/view used ...
4.3CVSS5.4AI score0.00452EPSS
SaveExploits0References9Affected Software1
20