Description
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.
Published: 2026-09-22
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization bypass
Action: Apply patch
AI Analysis

Impact

Nautobot’s approval workflow REST API endpoint that creates approval workflow stage responses does not enforce approver group membership, required change permissions, or the one‑response‑per‑user rule. A user with the extras.add_approvalworkflowstageresponse permission can craft a response that indicates approval, set the responder field to any user, and provide the desired job state. This flaw allows attackers to satisfy the minimum number of approvers required by a workflow, consequently marking the workflow as approved and activating its gated ScheduledJob. The weakness is a classic example of improper authorization controls as described by CWE‑285 and a classic bypass of authentication logic in approval processes (CWE‑639).

Affected Systems

All Nautobot installations from version 3.0.0 through 3.1.7 are affected. The issue was fixed in Nautobot 3.1.8 and later. The vulnerable product is the Nautobot Network Source of Truth and Network Automation Platform.

Risk and Exploitability

The CVSS score of 6.4 indicates a medium impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no public exploit is known. The likely attack vector is a user who has API access and the extras.add_approvalworkflowstageresponse permission, either internally or from an external source with authenticated access. While the vulnerability requires no special network privilege, it can lead to unauthorized execution of scheduled automation tasks. The risk profile is moderate for environments where the affected permission is broadly distributed.

Generated by OpenCVE AI on September 22, 2026 at 22:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Nautobot to version 3.1.8 or later, which restores enforcement of approver‑group checks and approval workflow rules.
  • Restrict or remove the extras.add_approvalworkflowstageresponse permission from users who do not require the ability to create approval responses, ensuring only trusted administrators can submit responses.
  • Audit the scheduled jobs that may have been activated by forged responses, and manually revoke or replace any jobs that were executed without proper approval.

Generated by OpenCVE AI on September 22, 2026 at 22:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-q4c5-2j6f-r476 Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
History

Sat, 26 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 22 Sep 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Nautobot
Nautobot nautobot
Vendors & Products Nautobot
Nautobot nautobot

Tue, 22 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Description Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-response-per-user restriction applied by the intended approve and deny actions. A user with only extras.add_approvalworkflowstageresponse can submit approved responses directly, while writable user and state fields permit responses to be attributed to arbitrary users. These forged responses can satisfy min_approvers, approve the workflow, and activate its gated ScheduledJob without a legitimate approver. This issue is fixed in version 3.1.8.
Title Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs
Weaknesses CWE-285
CWE-639
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Nautobot Nautobot
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-26T00:09:18.288Z

Reserved: 2026-08-31T23:04:48.172Z

Link: CVE-2026-83805

cve-icon Vulnrichment

Updated: 2026-09-26T00:09:14.197Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-22T20:17:09.487

Modified: 2026-09-26T01:17:02.700

Link: CVE-2026-83805

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-22T22:15:07Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key