Nautobot, a network automation platform, allowed the REST API to create or update objects that contain a GenericForeignKey reference without enforcing the user’s “view” permissions. The vulnerability permits an attacker with API access to reference objects that they should not be able to see, granting them elevated visibility into protected data. This missing authorization flaw is identified as CWE‑862 and can lead to privilege escalation by exposing sensitive object relationships.

The issue affected all versions of Nautobot prior to 2.4.33 and 3.1.2. Users deploying Nautobot 2.4.32, 2.4.31, 3.1.1 or earlier must be aware that the REST API can create improper GenericForeignKey links, potentially leaking confidential information.

The CVSS score of 5.4 classifies this as a moderate risk vulnerability. EPSS data is unavailable and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires API access and the ability to create or update objects; the attack vector is likely client‑side via the exposed API endpoints. Although the current publicly available evidence does not indicate widespread exploitation, the lack of permission checking represents a significant opportunity for attackers to gain unauthorized access to back-end objects.