NetBox versions up to 4.7.0 do not properly scope user‑private notifications, subscriptions, and bookmarks in REST and GraphQL API endpoints. The flaw permits any authenticated user with view rights to retrieve private records belonging to other users, revealing watch and bookmark activity that is meant to remain confidential.

The vulnerability affects the NetBox product developed by netbox‑community. All released versions through 4.7.0 are impacted; the issue has been fixed in later releases (e.g., 4.7.1 and beyond).

The CVSS score of 5.3 places the flaw in the medium severity range. Because the exploit requires only normal authenticated access with view permissions, an attacker who has legitimate credentials can easily read private data, increasing the confidentiality risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be network‑based via API calls to the exposed endpoints, as the flaw is exercised through the REST and GraphQL interfaces.