{"action":"Upgrade nautobot to 1.6.23 or later.","affected":[{"fixed":"1.6.23","introduced":"1.3.0"},{"fixed":"2.2.5","introduced":"2.0.0"}],"component":"nautobot","cve_ids":["CVE-2024-36112"],"ecosystem":"PyPI","epss":0.00398,"exploited":false,"fixed_versions":["1.6.23","2.2.5"],"ghsa_id":"GHSA-qmjf-wc2h-6x3q","id":"tcs_01M5KFWCJFJDV02PH43CY6XMCE","modified_at":"2026-06-10T17:14:16.271236375Z","published_at":"2024-05-29T18:40:56Z","references":["https://osv.dev/vulnerability/GHSA-qmjf-wc2h-6x3q","https://github.com/nautobot/nautobot/security/advisories/GHSA-qmjf-wc2h-6x3q","https://nvd.nist.gov/vuln/detail/CVE-2024-36112","https://github.com/nautobot/nautobot/pull/5757","https://github.com/nautobot/nautobot/pull/5762","https://github.com/nautobot/nautobot/commit/3a63aa1327f943b2ac8452757ea2e4d403387ad6","https://github.com/nautobot/nautobot/commit/4d1ff2abe2775b0a6fb16e6d1d503a78226a6f8e","https://github.com/nautobot/nautobot","https://github.com/pypa/advisory-database/tree/main/vulns/nautobot/PYSEC-2024-166.yaml"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"GHSA-qmjf-wc2h-6x3q","url":"https://osv.dev/vulnerability/GHSA-qmjf-wc2h-6x3q"}],"summary":"Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects"}