{"id":"CVE-2023-51649","aliases":["EUVD-2023-0181","GHSA-vf5m-xrhm-v999","PYSEC-2023-287"],"status":"published","title":"Nautobot missing object-level permissions enforcement when running Job Buttons","description":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00448,"percentile":0.39283,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2023-12-22T16:48:19Z","modified":"2026-10-28T02:30:43Z","fixes":[{"ecosystem":"PyPI","package":"nautobot","fixed_in":["1.6.8","2.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.14"},{"fixed":"1.6.8"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.14"},{"fixed":"1.6.8"}]}],"versions":["1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7"]},{"source":"osv","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.1.0"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0b1"]},{"source":"osv","ecosystem":"PyPI","package":"nautobot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.14"},{"fixed":"1.6.8"},{"introduced":"2.0.0"},{"fixed":"2.1.0"}]}],"versions":["1.5.14","1.5.15","1.5.16","1.5.17","1.5.18","1.5.19","1.5.20","1.5.21","1.5.22","1.5.23","1.5.24","1.6.0","1.6.1","1.6.2","1.6.3","1.6.4","1.6.5","1.6.6","1.6.7","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.1.0b1"]}],"products":[{"vendor":"nautobot","product":"nautobot"},{"vendor":"networktocode","product":"nautobot"}],"references":[{"url":"https://github.com/nautobot/nautobot/security/advisories/GHSA-vf5m-xrhm-v999","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","web","fix"]},{"url":"https://github.com/nautobot/nautobot/issues/4988","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report","web"]},{"url":"https://github.com/nautobot/nautobot/pull/4993","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/nautobot/nautobot/pull/4995","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-51649","tags":["advisory"]},{"url":"https://github.com/nautobot/nautobot/commit/3d964f996f4926126c1d7853ca87b2ff475997a2","tags":["web"]},{"url":"https://github.com/nautobot/nautobot/commit/d33d0c15a36948c45244e5b5e10bc79b8e62de7f","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2023-287.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vf5m-xrhm-v999"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51649.json","tags":["advisory"]},{"url":"https://github.com/nautobot/nautobot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-51649","title":"Nautobot missing object-level permissions enforcement when running Job Buttons","description":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0 ","status":"published","published":"2023-12-22T16:48:19.711Z","modified":"2024-08-02T22:40:33.995Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:17.48054Z"}],"euvd":[{"id":"EUVD-2023-0181","description":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0 ","status":"published","published":"2023-12-22T16:48:19Z","modified":"2024-08-02T22:40:33Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T03:26:07.206777Z"}],"ghsa":[{"id":"GHSA-vf5m-xrhm-v999","title":"Nautobot missing object-level permissions enforcement when running Job Buttons","description":"### Impact\n\nWhen submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general?). Object-level permissions (i.e., does the user have permission to run this *specific* Job?) are not enforced by the URL/view used in this case (`/extras/job-button/\u003cuuid\u003e/run/`) The effect is that a user with permissions to run even a single Job can actually run all configured JobButton Jobs.\n\n\u003e Not all Jobs can be configured as JobButtons; only those implemented as subclasses of `JobButtonReceiver` can be used in this way, so this vulnerability only applies specifically to `JobButtonReceiver` subclasses.\n\nAdditionally, although the documentation states that both `extras.run_job` permission and `extras.run_jobbutton` permission must be granted to a user in order to run Jobs via JobButton, the `extras.run_jobbutton` permission is not actually enforced by the view code, only by the UI by disabling the button from being clicked normally. Furthermore, the `extras.run_jobbutton` permission never prevented invoking Jobs (including `JobButtonReceiver` subclasses) via the normal \"Job Run\" UI, so after some discussion, we've decided that the `extras.run_jobbutton` permission is redundant, and as it never achieved its stated/documented purpose, the fixes below will remove the UI check for `extras.run_jobbutton` and all other references to the `extras.run_jobbutton` permission, rather than adding enforcement of this previously unenforced permission.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFix will be available in Nautobot 1.6.8 (https://github.com/nautobot/nautobot/pull/4995) and 2.1.0 (https://github.com/nautobot/nautobot/pull/4993)\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nPartial mitigation can be achieved by auditing `JobButtonReceiver` subclasses defined in the system and restricting which users are permitted to create or edit JobButton records. \n\n### References\n\n- https://github.com/nautobot/nautobot/issues/4988\n- https://github.com/nautobot/nautobot/pull/4993\n- https://github.com/nautobot/nautobot/pull/4995","status":"published","published":"2023-12-22T19:51:53Z","modified":"2026-06-09T13:05:10Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:40:24.856614Z"}],"nvd":[{"id":"CVE-2023-51649","description":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0 ","status":"published","published":"2023-12-22T17:15:10.197Z","modified":"2026-06-17T06:41:24.013Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:08:57.117371Z"}],"osv":[{"id":"CVE-2023-51649","title":"Nautobot missing object-level permissions enforcement when running Job Buttons","description":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0 ","status":"published","published":"2023-12-22T16:48:19.711Z","modified":"2026-10-28T02:30:43.629719047Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"GHSA-vf5m-xrhm-v999","title":"Nautobot missing object-level permissions enforcement when running Job Buttons","description":"### Impact\n\nWhen submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general?). Object-level permissions (i.e., does the user have permission to run this *specific* Job?) are not enforced by the URL/view used in this case (`/extras/job-button/\u003cuuid\u003e/run/`) The effect is that a user with permissions to run even a single Job can actually run all configured JobButton Jobs.\n\n\u003e Not all Jobs can be configured as JobButtons; only those implemented as subclasses of `JobButtonReceiver` can be used in this way, so this vulnerability only applies specifically to `JobButtonReceiver` subclasses.\n\nAdditionally, although the documentation states that both `extras.run_job` permission and `extras.run_jobbutton` permission must be granted to a user in order to run Jobs via JobButton, the `extras.run_jobbutton` permission is not actually enforced by the view code, only by the UI by disabling the button from being clicked normally. Furthermore, the `extras.run_jobbutton` permission never prevented invoking Jobs (including `JobButtonReceiver` subclasses) via the normal \"Job Run\" UI, so after some discussion, we've decided that the `extras.run_jobbutton` permission is redundant, and as it never achieved its stated/documented purpose, the fixes below will remove the UI check for `extras.run_jobbutton` and all other references to the `extras.run_jobbutton` permission, rather than adding enforcement of this previously unenforced permission.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nFix will be available in Nautobot 1.6.8 (https://github.com/nautobot/nautobot/pull/4995) and 2.1.0 (https://github.com/nautobot/nautobot/pull/4993)\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nPartial mitigation can be achieved by auditing `JobButtonReceiver` subclasses defined in the system and restricting which users are permitted to create or edit JobButton records. \n\n### References\n\n- https://github.com/nautobot/nautobot/issues/4988\n- https://github.com/nautobot/nautobot/pull/4993\n- https://github.com/nautobot/nautobot/pull/4995","status":"published","published":"2023-12-22T19:51:53Z","modified":"2026-06-09T13:15:18.125980805Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"PYSEC-2023-287","description":"Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0 ","status":"published","published":"2023-12-22T17:15:00Z","modified":"2026-06-08T11:15:05.721632481Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:53.837392Z"}]}}