SecurityFan score 20 · Tier C
Allowed to view the Location, handed the Device: a GraphQL permission gap in Nautobot (GHSA-mfwj-pjgx-22v2)
DEV · By Santosh Kumar Puppala ·
The Brief
- Nautobot's GraphQL API checked object permissions at the root of a query but not when the query traversed into related models.
- In the author's local test on v3.1.4, an account with view permission on Location and no device permission got a 403 from the REST device list but could still reach device data through a GraphQL query.
- The issue is tracked as GHSA-mfwj-pjgx-22v2.
Why it matters
Users with limited GraphQL access can read related objects they are not permitted to view, so object-level permissions in Nautobot may not hold for GraphQL queries.
Who’s affected
- Nautobot operators who rely on object permissions
- Teams exposing the Nautobot GraphQL API to users
- Nautobot 3.1.4
- #nautobot
- #graphql
- #permissions
- #authorization
- #vulnerability
TL;DR What: Nautobot 's GraphQL API enforced object permissions at the root of a query but not when a query traversed into related models. In my local test on v3.1.4, an account with view permission on Location and no device permission got a 403 from the REST device list and an…