Authorization bypass exposes private netbox-community NetBox records through REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can access all users' private records through unscoped querysets, disclosing which users watch or bookmark which objects.

• netbox-community NetBox: default status is unaffected, but semver records from 0 through 4.7.0, inclusive, are marked affected.
• The affected scope includes REST and GraphQL APIs for Notifications, Subscriptions, and Bookmarks.
• No fixed version boundary is supplied. patch_available is marked true but is not tied to a specific release, so later or parallel branches should not be treated as unaffected without separate confirmation.

NetBox treats Notifications, Subscriptions, and Bookmarks as per-user private records, but the affected REST viewsets and GraphQL resolvers use broad querysets instead of binding results to the requesting user. The researcher advisory identifies Model.objects.all() and the missing user=request.user filter as the core authorization gap. An authenticated client can reach these API surfaces; exposure normally requires the relevant model-level view permission, but configurations using EXEMPT_VIEW_PERMISSIONS=['*'] can make the records available to any authenticated user. Returned data can include the owner's username or identity and the name or display value of the referenced object, depending on the fields exposed by the API and the requester's other permissions. This is an authorization failure classified as CWE-639. The available evidence confirms the missing per-user filtering, but does not establish whether every deployment exposes the same fields or whether a particular configuration has already been abused.

The flaw is reachable over the network through REST and GraphQL APIs. An attacker needs an authenticated account or token; the usual condition is the relevant view permission, and no separate user interaction is required. The record includes a public researcher advisory with validation against the shipped viewsets and GraphQL schema, so public exploitation detail exists. The EXEMPT_VIEW_PERMISSIONS=['*'] configuration can broaden access to any authenticated user. The supplied evidence does not establish whether the flaw has been exploited in the wild.

Successful exploitation allows an authenticated user to read other users' private data across the authorization boundary. The disclosed data can associate user identities with watched or bookmarked objects, increasing the risk of inferring infrastructure, work, or operational activity. The primary effect is loss of confidentiality within NetBox; there is no evidence that this issue permits record modification or service disruption. The amount of exposure depends on view permissions, wildcard configuration, and the fields returned by each API.

The flaw breaks the privacy boundary between users and can disclose user identities together with the objects they watch or bookmark. Names of sites, devices, IP addresses, circuits, or other infrastructure may reveal operational structure and user interests when those values appear in the records. This can affect privacy, internal information segmentation, and the protection of monitoring or investigative activity. The available evidence establishes a confidentiality impact only; it does not establish data modification or service disruption.

1. Deploy a vendor-maintained fix when a fixed release is confirmed. The supplied record and consulted advisory do not identify an exact fixed release, so do not automatically treat a later release as fixed.
2. Until a fix is available, restrict or remove extras.view_notification, extras.view_subscription, and extras.view_bookmark from users or API tokens that do not need API access. This reduces exposure but does not correct the underlying code.
3. If EXEMPT_VIEW_PERMISSIONS=['*'] is enabled, disable the wildcard or exclude these three models through EXEMPT_EXCLUDE_MODELS so wildcard access cannot expose the private records.
4. Review logs and assess whether private records were returned to accounts other than their owners. If disclosure is confirmed, follow the organization's data exposure response process.

1. Inventory NetBox deployments and compare their running releases with the affected branch recorded for this issue.
2. Review object permissions assigned for extras.view_notification, extras.view_subscription, and extras.view_bookmark, especially for low-privilege users and API tokens.
3. Check EXEMPT_VIEW_PERMISSIONS; when a wildcard is configured, determine whether Notifications, Subscriptions, and Bookmarks are excluded.
4. In an authorized test environment, verify that REST and GraphQL responses contain only records belonging to the requesting user and do not return another user's records.
5. Review access logs for notification, subscription, and bookmark collections and for GraphQL list queries. This is precautionary monitoring, not a confirmed indicator.
6. A limited test that does not show cross-user records does not prove safety when permissions or deployment settings differ.