Search results

REST API serializes generic-FK targets without a view-permission check

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

#22514 In netbox-community/netbox;

· jnovinger opened on Jun 23, 2026

JournalEntry.created_by can be reassigned on update via REST API and bulk import (audit-trail spoofing)

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

#22513 In netbox-community/netbox;

· jnovinger opened on Jun 23, 2026

CustomFieldsDataField renders OBJECT/MULTIOBJECT custom-field targets without restrict() (read-path disclosure)

breaking changeThis change modifies or removes some previously documented functionalityThis change modifies or removes some previously documented functionality

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

#22512 In netbox-community/netbox;

· jnovinger opened on Jun 23, 2026

·  

v4.7.0

Several alter_object() views resolve parent objects without restrict() (object-level IDOR)

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

#22511 In netbox-community/netbox;

· jnovinger opened on Jun 23, 2026

Opt-in RFC 9457 Problem Details for REST API error responses

netbox

status: needs triageThis issue is awaiting triage by a maintainerThis issue is awaiting triage by a maintainer

type: featureIntroduction of new functionality to the applicationIntroduction of new functionality to the application

Status: Open.

Feature

#22504 In netbox-community/netbox;

· jnovinger opened on Jun 22, 2026

Server-side retry on database deadlock and lock timeout for write requests

netbox

status: needs triageThis issue is awaiting triage by a maintainerThis issue is awaiting triage by a maintainer

type: featureIntroduction of new functionality to the applicationIntroduction of new functionality to the application

Status: Open.

Feature

#22503 In netbox-community/netbox;

· jnovinger opened on Jun 22, 2026

Add test coverage for handle_rest_api_exception

netbox

type: housekeepingChanges to the application which do not directly impact the end userChanges to the application which do not directly impact the end user

Status: Open.

Housekeeping

#22502 In netbox-community/netbox;

· jnovinger opened on Jun 22, 2026

GraphQL 500 responses render HTML instead of JSON

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

Bug

#22501 In netbox-community/netbox;

· jnovinger opened on Jun 22, 2026

Maintenance mode message discarded for REST API requests

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

Bug

#22500 In netbox-community/netbox;

· jnovinger opened on Jun 22, 2026

Constraints in Permissions: Mention requirements of double-escaping for regex

netbox

status: needs triageThis issue is awaiting triage by a maintainerThis issue is awaiting triage by a maintainer

type: documentationA change or addition to the documentationA change or addition to the documentation

Status: Open.

Documentation

#22498 In netbox-community/netbox;

· mathieumd opened on Jun 22, 2026

Bulk-deleting many objects is extremely slow due to per-object cascade and N+1 counter updates

netbox

status: needs ownerThis issue is tentatively accepted pending a volunteer committed to its implementationThis issue is tentatively accepted pending a volunteer committed to its implementation

type: performanceA concern regarding application performanceA concern regarding application performance

Status: Open.

Performance

#22497 In netbox-community/netbox;

· MohamedKhelifi opened on Jun 21, 2026

Virtual Chassis reference on Device is not updated when Virtual Chassi changes name

netbox

severity: lowDoes not significantly disrupt application functionality, or a workaround is availableDoes not significantly disrupt application functionality, or a workaround is available

status: acceptedThis issue has been accepted for implementationThis issue has been accepted for implementation

type: bugA confirmed report of unexpected behavior in the applicationA confirmed report of unexpected behavior in the application

Status: Open.

Bug

#22489 In netbox-community/netbox;

· Chiniquy opened on Jun 18, 2026

·  

v4.6.4