Insufficient read permissions lead to unintended relationship deletion #589

New Issue

MrUnknownDE · 2026-04-05T16:48:06+02:00

MrUnknownDE commented

2026-04-05 16:48:06 +02:00

Originally created by @loubladi on 1/14/2026

NetBox Edition

NetBox Community

NetBox Version

v4.5.0

Python Version

3.12

Steps to Reproduce

Create a user with:
Permission to edit devices
No permission to view tags
Assign one or more tags to a device.
Log in as the restricted user.
Open the device edit form.
Change any field (e.g., description or role) and save.

Expected Behavior

Tags that the user cannot see or manage should be preserved when saving the device.
Alternatively, tag fields should be treated as read-only or ignored during save operations if the user lacks tag permissions.

Observed Behavior

All previously assigned tags are removed from the device after saving.

This behavior is reproducible across all object-to-object relationships. For instance, when a device assigned to a rack is edited by a user without permission to view racks, the rack assignment is silently removed.

*Originally created by @loubladi on 1/14/2026* ### NetBox Edition NetBox Community ### NetBox Version v4.5.0 ### Python Version 3.12 ### Steps to Reproduce 1. Create a user with: Permission to edit devices No permission to view tags 2. Assign one or more tags to a device. 3. Log in as the restricted user. 4. Open the device edit form. 5. Change any field (e.g., description or role) and save. ### Expected Behavior Tags that the user cannot see or manage should be preserved when saving the device. Alternatively, tag fields should be treated as read-only or ignored during save operations if the user lacks tag permissions. ### Observed Behavior All previously assigned tags are removed from the device after saving. This behavior is reproducible across all object-to-object relationships. For instance, when a device assigned to a rack is edited by a user without permission to view racks, the rack assignment is silently removed.

MrUnknownDE closed this issue

2026-04-05 16:48:06 +02:00

Sign in to join this conversation.

Branches Tags

main

21455-sql-indexes-audit

21357-register-model-actions

feature

20924-plugin-ui-components

21766-improve-test-coverage-for-sortable-table-columns

21157-export-template-public-models

21025-pre-render-config-contexts

21364-swagger

feature-ip-prefix-link

20911-dropdown-3

fix_module_substitution

21160-filterset

20911-dropdown-2

20044-elevation-stuck-lightmode

7604-filter-modifiers-v3

20660-script-load

19724-graphql

14884-script

19720-macaddress-interface-generic-relation

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

No Label netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox netbox status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate status: duplicate type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug type: bug

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/netbox#589