starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

User and group queries are not properly restricted via GraphQL API in v4.0.2 Re-Open #9712

New Issue
Closed
opened 2025-12-29 21:21:29 +01:00 by adam · 2 comments
adam commented 2025-12-29 21:21:29 +01:00
Owner
Copy Link

Originally created by @marsteel on GitHub (May 21, 2024).

Originally assigned to: @jeremystretch on GitHub.

Deployment Type

Self-hosted

NetBox Version

v4.0.2

Python Version

3.10

Steps to Reproduce

This is is to re-opent #7814

Create New Group netbox-graphql. Don't add any permission to the group.
Add new user to the group
Login as new user
Access https://netbox/graphql

query {
user_list{
username
password
}
}

Username and hash in password returned.

Expected Behavior

Empty result retured because the user in a group without permission to Group/User view.

Observed Behavior

All Username and hash in Database returned.

Originally created by @marsteel on GitHub (May 21, 2024). Originally assigned to: @jeremystretch on GitHub. ### Deployment Type Self-hosted ### NetBox Version v4.0.2 ### Python Version 3.10 ### Steps to Reproduce This is is to re-opent #7814 Create New Group netbox-graphql. Don't add any permission to the group. Add new user to the group Login as new user Access https://netbox/graphql query { user_list{ username password } } Username and hash in password returned. ### Expected Behavior Empty result retured because the user in a group without permission to Group/User view. ### Observed Behavior All Username and hash in Database returned.
adam added the type: bugstatus: acceptedseverity: high labels 2025-12-29 21:21:29 +01:00
adam closed this issue 2025-12-29 21:21:30 +01:00
adam commented 2025-12-29 21:21:30 +01:00
Author
Owner
Copy Link

@jeremystretch commented on GitHub (May 21, 2024):

Users who need to remediate this immediately can set GRAPHQL_ENABLED = False in configuration.py temporarily to disable the GraphQL API.

@jeremystretch commented on GitHub (May 21, 2024): Users who need to remediate this immediately can set `GRAPHQL_ENABLED = False` in `configuration.py` temporarily to disable the GraphQL API.
adam commented 2025-12-29 21:21:30 +01:00
Author
Owner
Copy Link

@kiraum commented on GitHub (May 21, 2024):

Just noticed the same, token without permissions, and able to get data via graphql.

>>> response.json()
{'data': {'asn': {'asn': 666}}

2024-05-21 21:06:52 UTC 67cf2994a159 (v4.0.2)

@kiraum commented on GitHub (May 21, 2024): Just noticed the same, token without permissions, and able to get data via graphql. ``` >>> response.json() {'data': {'asn': {'asn': 666}} ``` `2024-05-21 21:06:52 UTC 67cf2994a159 (v4.0.2)`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label severity: high status: accepted type: bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#9712
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?