CVE-2026-83805
mediumpriority · track · 0EPSS 0.003 · 22 %ileUSEPSS · scored 2026-10-28
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (1)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-q4c5-2j6f-r476Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs2026-09-22ghsa · osvUS
### Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks (approver-group membership, `change` permission on the object under review, one-response-per-user) are enforced only in the `approve`/`deny` actions on `ApprovalWorkflowStage`. The generic `ApprovalWorkflowStageResponse` create endpoint enforces none of them, so a user holding only `extras.add_approvalworkflowstageresponse` can `POST` approved responses directly and drive a stage past its `min_approvers` threshold with no legitimate approver involved. The serializer also exposes `user` and `state` as writable, letting the attacker attribute responses to arbitrary users. 2. Escalated impact job activation: Because the approval workflow gates a `ScheduledJob`, self-approval does not stop at the approval record. Stage approval cascades through `ApprovalWorkflow.save()` to `on_workflow_approved()`, which sets the target job to enabled/active. ### Patches Fixed in Nautobot v3.1.8 ### Workarounds Restrict the `extras.add_approvalworkflowstageresponse` permission so that no untrusted user holds it; approval responses should only ever be created via the stage `approve`/`deny` actions. There is no configuration flag that disables the generic create endpoint prior to the patch.
- PYSEC-2026-4111Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs2026-10-01vendor · osvUS
### Impact This is an authorization bypass that escalates into unauthorized server-side job execution. 1. Primary impact - self-approval: The approver checks (approver-group membership, `change` permission on the object under review, one-response-per-user) are enforced only in the `approve`/`deny` actions on `ApprovalWorkflowStage`. The generic `ApprovalWorkflowStageResponse` create endpoint enforces none of them, so a user holding only `extras.add_approvalworkflowstageresponse` can `POST` approved responses directly and drive a stage past its `min_approvers` threshold with no legitimate approver involved. The serializer also exposes `user` and `state` as writable, letting the attacker attribute responses to arbitrary users. 2. Escalated impact job activation: Because the approval workflow gates a `ScheduledJob`, self-approval does not stop at the approval record. Stage approval cascades through `ApprovalWorkflow.save()` to `on_workflow_approved()`, which sets the target job to enabled/active. ### Patches Fixed in Nautobot v3.1.8 ### Workarounds Restrict the `extras.add_approvalworkflowstageresponse` permission so that no untrusted user holds it; approval responses should only ever be created via the stage `approve`/`deny` actions. There is no configuration flag that disables the generic create endpoint prior to the patch.
also known as (2)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3) nvd
External citations — patches, advisories, analysis.
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan