{"vulnerability": "cve-2026-8380", "sightings": [{"uuid": "4d534e61-d2f0-4d6c-8cc0-6304b98e0e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8380", "type": "seen", "source": "Telegram/vo-VgstXQuzhPYqY8B85GwxskfRMHrGkVpymMR7KirmWNUQ", "content": "", "creation_timestamp": "2026-05-28T15:00:16.000000Z"}, {"uuid": "f1697ea6-708c-41c4-b1ee-22d22bfe4618", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8380", "type": "seen", "source": "Telegram/gT5VG53EHkYx7lJsNMzVATNBd8Pb7In7gs06zL9W87J77Dc", "content": "", "creation_timestamp": "2026-05-28T21:00:04.000000Z"}, {"uuid": "732a5604-4d0b-4b29-b1ea-f261dbbf5f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8380", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mp6gelt7h32l", "content": "Frontend File Manager Plugin for WordPress (\u226423.6) has a HIGH severity flaw: author+ users (or guests, if enabled) can delete any post/page. Disable 'Allow guest uploads' now. Patch status unknown. https://radar.offseq.com/threat/cve-2026-8380-cwe-73-external-control-of-file-name-aa5b0eb592b68479...", "creation_timestamp": "2026-06-26T07:30:28.526202Z"}, {"uuid": "b0a09ff8-b9f3-40b6-ab43-84c6803e41e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-8380", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116815234676437160", "content": "CVE-2026-8380: HIGH severity in Frontend File Manager Plugin (\u226423.6) for WordPress. Author+ users can delete any post/page; guest deletion possible if enabled. Disable 'Allow guest uploads' until patched. https://radar.offseq.com/threat/cve-2026-8380-cwe-73-external-control-of-file-name-aa5b0eb592b68479 #OffSeq #WordPress #Vuln #BlueTeam", "creation_timestamp": "2026-06-26T07:30:34.407296Z"}, {"uuid": "cfce299d-4127-45ae-9755-1f9434b4add9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83803", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw5wvsirrz2k", "content": "CVE-2026-83803 - sentry\nSelf-hosted Sentry versions 23.11.0 through 26.7.0 allow a logged\u2011in user to create a specially crafted relocation archive that, when imported, can cause the system to execute any\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sentry #getsentry #CVE #infosec", "creation_timestamp": "2026-09-23T04:50:06.371971Z"}, {"uuid": "03161634-cf34-472a-9957-b608f3f99718", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83805", "type": "seen", "source": "https://gist.github.com/alon710/e1072924de003b6765183a66872ae79e", "content": "# CVE-2026-83805: CVE-2026-83805: Authorization Bypass and Privilege Escalation in Nautobot Approval Workflows\n\n> **CVSS Score:** 6.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83805\n\n## Summary\nAn authorization bypass vulnerability exists in Nautobot's REST API endpoints handling approval workflows. Due to an architectural inconsistency, a standalone, generic REST API endpoint for creating approval responses was exposed without propagating the required business-logic validations. This allows low-privileged authenticated users to submit forged, self-approved votes, bypassing approval thresholds and triggering unauthorized server-side automated jobs.\n\n## TL;DR\nA validation discrepancy between Nautobot controllers allows authenticated low-privileged users to directly POST forged approval responses, bypass group and permission checks, and trigger the execution of privileged automated tasks.\n\n## Technical Details\n\n- **CWE ID**: CWE-285\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 6.4 (Medium)\n- **EPSS Score**: 0.00\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nautobot Network Automation Platform\n- **Nautobot**: >= 3.0.0, < 3.1.8 (Fixed in: `3.1.8`)\n\n## Mitigation\n\n- Upgrade Nautobot deployments to version 3.1.8 or higher.\n- Revoke the 'extras.add_approvalworkflowstageresponse' permission from non-administrative users.\n- Implement WAF/API Gateway rules to block modification methods targeting the response endpoints.\n\n**Remediation Steps:**\n1. Inspect current Nautobot deployment versions and schedule an upgrade to 3.1.8.\n2. Apply database queries to audit for incongruencies between the logged transaction user and the record's user attribute.\n3. Modify default Django user group permissions to restrict approval response addition capabilities.\n\n## References\n\n- [GHSA-q4c5-2j6f-r476 Security Advisory](https://github.com/nautobot/nautobot/security/advisories/GHSA-q4c5-2j6f-r476)\n- [Nautobot Fix Commit 8682707](https://github.com/nautobot/nautobot/commit/8682707d0391cbfd7694e3276127b78dc9cf29d8)\n- [Nautobot Release v3.1.8 Official Tag](https://github.com/nautobot/nautobot/releases/tag/v3.1.8)\n- [NVD - CVE-2026-83805](https://nvd.nist.gov/vuln/detail/CVE-2026-83805)\n- [CVE.org - CVE-2026-83805](https://www.cve.org/CVERecord?id=CVE-2026-83805)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83805) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T12:31:40.727694Z"}, {"uuid": "03adfa94-b11b-47cd-9534-24ab238bd10c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-83801", "type": "seen", "source": "https://gist.github.com/alon710/f4948b85008393550183db83af47c6eb", "content": "# CVE-2026-83801: CVE-2026-83801: Stored Cross-Site Scripting via Form Help Text in Nautobot\n\n> **CVSS Score:** 5.4\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-83801\n\n## Summary\nCVE-2026-83801 is a stored Cross-Site Scripting (XSS) vulnerability in Nautobot. The vulnerability arises because the application interpolates user-controlled database properties\u2014specifically Relationship descriptions and Module Family names\u2014directly into the help_text parameter of Django form fields. These fields are rendered using Django's |safe filter, bypassing HTML escaping and enabling persistent injection. When an administrative user accesses the affected forms, the payload executes contextually in their browser. This allows attackers to hijack active sessions and perform unauthorized operations. Nautobot versions prior to v2.4.37 and v3.1.8 are affected by this vulnerability. The issue has been patched by implementing contextual HTML escaping and strict markdown sanitization.\n\n## TL;DR\nA stored XSS vulnerability in Nautobot allows low-privileged administrative users to inject malicious scripts into Module Family names or Relationship descriptions, executing arbitrary code when viewed by other users.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-79\n- **Attack Vector**: Network\n- **CVSS Severity**: 5.4 (Medium)\n- **EPSS Status**: Not established\n- **Impact**: Stored Cross-Site Scripting (XSS)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Nautobot v2.x before v2.4.37\n- Nautobot v3.x before v3.1.8\n- **Nautobot**: >= 2.0.0, < 2.4.37 (Fixed in: `v2.4.37`)\n- **Nautobot**: >= 3.0.0, < 3.1.8 (Fixed in: `v3.1.8`)\n\n## Mitigation\n\n- Upgrade to patched versions\n- Restrict form-modifying administrative permissions\n- Sanitize database entries containing potential payloads\n\n**Remediation Steps:**\n1. Identify current Nautobot version\n2. If on v2.x, upgrade to v2.4.37 or later\n3. If on v3.x, upgrade to v3.1.8 or later\n4. Run diagnostic queries to check for existing script tags in ModuleFamily and Relationship models\n\n## References\n\n- [GitHub Security Advisory GHSA-56v6-2fhr-wxgq](https://github.com/nautobot/nautobot/security/advisories/GHSA-56v6-2fhr-wxgq)\n- [NVD - CVE-2026-83801](https://nvd.nist.gov/vuln/detail/CVE-2026-83801)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-83801) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T13:31:59.806926Z"}]}