Auth bypass in Nautobot
CVE-2026-83805
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.
Published .
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Nautobot — versions >= 3.0.0, < 3.1.8
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-83805?
- CVE-2026-83805 is a medium-severity vulnerability in Nautobot, classified under Improper Authorization. CVSS score: 6.4/10. Published 2026-09-22.
- How severe is CVE-2026-83805?
- Medium severity. CVSS v3 base score is 6.4 out of 10.