-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing permission checks when accessing dynamic group members. The key evidence is in the commit diffs:- In api/views.py, the members endpoint changed from 'instance.members' to 'instance.members.restrict()'- In views.py, the UI table changed from 'instance.members' to 'instance.members.restrict()'These functions directly handled member object retrieval without applying Nautobot's permission system (restrict()), which normally enforces object-level permissions. The tests added in test_api.py and test_views.py explicitly validate the permission enforcement, confirming these were the vulnerable points.
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nautobot | pip | >= 1.3.0, < 1.6.23 | 1.6.23 |
| nautobot | pip | >= 2.0.0, < 2.2.5 | 2.2.5 |
Ongoing coverage of React2Shell