User and group queries are not properly restricted via GraphQL API in v4.0.2 Re-Open

[marsteel]

Deployment Type

Self-hosted

NetBox Version

v4.0.2

Python Version

3.10

Steps to Reproduce

This is is to re-opent #7814

Create New Group netbox-graphql. Don't add any permission to the group.
Add new user to the group
Login as new user
Access https://netbox/graphql

query {
user_list{
username
password
}
}

Username and hash in password returned.

Expected Behavior

Empty result retured because the user in a group without permission to Group/User view.

Observed Behavior

All Username and hash in Database returned.

[jeremystretch]

Users who need to remediate this immediately can set GRAPHQL_ENABLED = False in configuration.py temporarily to disable the GraphQL API.

[kiraum]

Just noticed the same, token without permissions, and able to get data via graphql.

>>> response.json()
{'data': {'asn': {'asn': 666}}

2024-05-21 21:06:52 UTC 67cf2994a159 (v4.0.2)