CVE-2026-44794

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44794", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-07T19:20:44.693Z", "datePublished": "2026-05-28T17:01:21.400Z", "dateUpdated": "2026-05-30T02:02:47.815Z"}, "containers": {"cna": {"title": "Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x"}, {"name": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b", "tags": ["x_refsource_MISC"], "url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b"}, {"name": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1", "tags": ["x_refsource_MISC"], "url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1"}, {"name": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33", "tags": ["x_refsource_MISC"], "url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33"}, {"name": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2"}], "affected": [{"vendor": "nautobot", "product": "nautobot", "versions": [{"version": ">= 3.0.0a2, < 3.1.2", "status": "affected"}, {"version": "< 2.4.33", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T17:01:21.400Z"}, "descriptions": [{"lang": "en", "value": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2."}], "source": {"advisory": "GHSA-wpxj-44w3-2j6x", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-30T02:02:38.997080Z", "id": "CVE-2026-44794", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-30T02:02:47.815Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference", "source": {"advisory": "GHSA-wpxj-44w3-2j6x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nautobot", "product": "nautobot", "versions": [{"status": "affected", "version": ">= 3.0.0a2, < 3.1.2"}, {"status": "affected", "version": "< 2.4.33"}]}], "references": [{"url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x", "name": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b", "name": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1", "name": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33", "name": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2", "name": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-28T17:01:21.400Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44794", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-30T02:02:38.997080Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-05-30T02:02:44.197Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-44794", "state": "PUBLISHED", "dateUpdated": "2026-05-28T17:01:21.400Z", "dateReserved": "2026-05-07T19:20:44.693Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-28T17:01:21.400Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nautobot", "vendor": "nautobot", "versions": [{"status": "affected", "version": ">= 3.0.0a2, < 3.1.2"}, {"status": "affected", "version": "< 2.4.33"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "matchCriteriaId": "1519124C-E6CD-44DF-8DD7-D4A7003ADF94", "versionEndExcluding": "2.4.33", "vulnerable": true}, {"criteria": "cpe:2.3:a:networktocode:nautobot:*:*:*:*:*:*:*:*", "matchCriteriaId": "8419C360-D723-4365-82B1-B4DE637BE43C", "versionEndExcluding": "3.1.2", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one of several different \"content types\" or database tables), when creating or updating an object containing a GenericForeignKey, Nautobot's REST API failed to enforce user \"view\" permissions when determining whether a given reference to another object would be valid. This vulnerability is fixed in 2.4.33 and 3.1.2."}, {"lang": "es", "value": "Nautobot es una Fuente de Verdad de Red y Plataforma de Automatizaci\u00f3n de Red. Antes de las versiones 2.4.33 y 3.1.2, en el caso de referencias entre objetos a trav\u00e9s de GenericForeignKey (un patr\u00f3n que permite a un objeto referenciar a otro objeto que puede pertenecer a uno de varios 'tipos de contenido' diferentes o tablas de base de datos), al crear o actualizar un objeto que contiene una GenericForeignKey, la API REST de Nautobot no aplicaba los permisos de 'vista' del usuario al determinar si una referencia dada a otro objeto ser\u00eda v\u00e1lida. Esta vulnerabilidad est\u00e1 corregida en las versiones 2.4.33 y 3.1.2."}], "id": "CVE-2026-44794", "lastModified": "2026-10-14T20:10:00.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44794", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-30T02:02:38.997080Z", "version": "2.0.3"}}]}, "published": "2026-05-28T18:16:33.203", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/nautobot/nautobot/releases/tag/v2.4.33"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/nautobot/nautobot/releases/tag/v3.1.2"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[3.0.0a2,3.1.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.4.33)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nautobot", "source": "cna", "vendor": "nautobot"}, "product": "nautobot", "vendor": "nautobot"}], "created": "2026-05-28T19:30:16.272545+00:00", "updated": "2026-05-28T19:30:16.611621+00:00", "vendors": ["nautobot", "nautobot$PRODUCT$nautobot"]}