NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers—including those with read‑only API tokens—to inject arbitrary Django ORM lookup expressions into nested object references by supplying crafted JSON dictionary keys in POST, PUT, or PATCH requests to any REST API endpoint. This flaw permits attackers to exploit the unrestricted queryset used by WritableNestedSerializer, enabling boolean‑based blind data extraction of sensitive field values and bypassing object‑level permissions across all application modules such as dcim, ipam, tenancy, virtualization, circuits, and extras. The primary impact is unauthorized disclosure of confidential data and elevation of privileges within the application, as attackers can obtain values normally protected by permissions.

NetBox by NetBox Labs, version 4.5.8, is affected. All modules that use the WritableNestedSerializer—including dcim, ipam, tenancy, virtualization, circuits, and extras—are potentially impacted by this vulnerability.

The CVSS score of 7.1 indicates a high severity, while the EPSS score of less than 1% suggests exploitation is currently unlikely; the vulnerability is not listed in CISA KEV. Attackers need to be authenticated to trigger the flaw, but read‑only API tokens suffice. Exploitation requires sending crafted JSON payloads to any REST API endpoint that uses WritableNestedSerializer; the attacker can then extract sensitive data through boolean‑based blind queries or read protected fields, bypassing normal permission checks.