{"action":"Upgrade nautobot to 2.4.33 or later.","affected":[{"fixed":"3.1.2","introduced":"3.0.0a2"},{"fixed":"2.4.33","introduced":"0"}],"component":"nautobot","cve_ids":["CVE-2026-44794"],"ecosystem":"PyPI","epss":0.00177,"exploited":false,"fixed_versions":["3.1.2","2.4.33"],"ghsa_id":"GHSA-wpxj-44w3-2j6x","id":"tcs_01M5KG2NB94242KR5E3QWE00NE","modified_at":"2026-07-13T07:26:41.685580208Z","published_at":"2026-05-13T15:30:46Z","references":["https://osv.dev/vulnerability/GHSA-wpxj-44w3-2j6x","https://github.com/nautobot/nautobot/security/advisories/GHSA-wpxj-44w3-2j6x","https://nvd.nist.gov/vuln/detail/CVE-2026-44794","https://github.com/nautobot/nautobot/commit/36cde7148a207234de6212ec074f321dbc9d1b5b","https://github.com/nautobot/nautobot/commit/9918bdb9bcf1eb42cda72c344f420a64ef7665f1","https://github.com/nautobot/nautobot","https://github.com/nautobot/nautobot/releases/tag/v2.4.33","https://github.com/nautobot/nautobot/releases/tag/v3.1.2"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-wpxj-44w3-2j6x","url":"https://osv.dev/vulnerability/GHSA-wpxj-44w3-2j6x"}],"summary":"Nautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference"}