GHSA-q4c5-2j6f-r476

Suggest an improvement
Source
https://github.com/advisories/GHSA-q4c5-2j6f-r476
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4c5-2j6f-r476/GHSA-q4c5-2j6f-r476.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-q4c5-2j6f-r476
Aliases
  • CVE-2026-83805
Published
2026-09-22T20:37:33Z
Modified
2026-09-22T21:00:12Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Details

Impact

This is an authorization bypass that escalates into unauthorized server-side job execution.

  1. Primary impact - self-approval: The approver checks (approver-group membership, change permission on the object under review, one-response-per-user) are enforced only in the approve/deny actions on ApprovalWorkflowStage. The generic ApprovalWorkflowStageResponse create endpoint enforces none of them, so a user holding only extras.add_approvalworkflowstageresponse can POST approved responses directly and drive a stage past its min_approvers threshold with no legitimate approver involved. The serializer also exposes user and state as writable, letting the attacker attribute responses to arbitrary users.

  2. Escalated impact job activation: Because the approval workflow gates a ScheduledJob, self-approval does not stop at the approval record. Stage approval cascades through ApprovalWorkflow.save() to on_workflow_approved(), which sets the target job to enabled/active.

Patches

Fixed in Nautobot v3.1.8

Workarounds

Restrict the extras.add_approvalworkflowstageresponse permission so that no untrusted user holds it; approval responses should only ever be created via the stage approve/deny actions. There is no configuration flag that disables the generic create endpoint prior to the patch.

Database specific 
{
    "cwe_ids":  [
        "CWE-285",
        "CWE-639"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-22T20:37:33Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / nautobot

Package

Name
nautobot
View open source insights on deps.dev
Purl
pkg:pypi/nautobot

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.1.8

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.1.0a1
3.1.0a2
3.1.0a3
3.1.0a4
3.1.0a5
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6
3.1.7

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-q4c5-2j6f-r476/GHSA-q4c5-2j6f-r476.json"