Vulnerability GHSA-q4c5-2j6f-r476

Impact

This is an authorization bypass that escalates into unauthorized server-side job execution.

1. Primary impact - self-approval: The approver checks (approver-group membership, change permission on the object under review, one-response-per-user) are enforced only in the approve/deny actions on ApprovalWorkflowStage. The generic ApprovalWorkflowStageResponse create endpoint enforces none of them, so a user holding only extras.add_approvalworkflowstageresponse can POST approved responses directly and drive a stage past its min_approvers threshold with no legitimate approver involved. The serializer also exposes user and state as writable, letting the attacker attribute responses to arbitrary users.

2. Escalated impact job activation: Because the approval workflow gates a ScheduledJob, self-approval does not stop at the approval record. Stage approval cascades through ApprovalWorkflow.save() to on_workflow_approved(), which sets the target job to enabled/active.

Patches

Fixed in Nautobot v3.1.8

Workarounds

Restrict the extras.add_approvalworkflowstageresponse permission so that no untrusted user holds it; approval responses should only ever be created via the stage approve/deny actions. There is no configuration flag that disables the generic create endpoint prior to the patch.