Search
Find a vulnerability
Search criteria
32 vulnerabilities found for InvenTree by inventree
CVE-2026-61749 (GCVE-0-2026-61749)
Vulnerability from nvd – Published: 2026-09-21 18:31 – Updated: 2026-09-24 22:29
VLAI
EPSS
VEX
Title
InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 22:29 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12160 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/2b4… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61749",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T22:29:08.431867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T22:29:20.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:31:54.532Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12160",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12160"
},
{
"name": "https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-568x-qh23-wh8g",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61749",
"datePublished": "2026-09-21T18:31:54.532Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-24T22:29:20.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61748 (GCVE-0-2026-61748)
Vulnerability from nvd – Published: 2026-09-21 18:47 – Updated: 2026-09-24 22:30
VLAI
EPSS
VEX
Title
InvenTree: Report/Label print endpoints ignore per-model permissions
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 22:30 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12142 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/73b… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61748",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T22:30:13.197826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T22:30:22.380Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller\u0027s per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:47:14.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12142",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12142"
},
{
"name": "https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-7w96-99fj-8g7x",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Report/Label print endpoints ignore per-model permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61748",
"datePublished": "2026-09-21T18:47:14.044Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-24T22:30:22.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61747 (GCVE-0-2026-61747)
Vulnerability from nvd – Published: 2026-09-21 18:44 – Updated: 2026-09-21 20:05
VLAI
EPSS
VEX
Title
InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:04 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12169 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/3c1… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:04:50.434899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:05:00.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user\u0027s import session identifier and retrieve that session\u0027s row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:44:15.662Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12169",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12169"
},
{
"name": "https://github.com/inventree/InvenTree/commit/3c17367e3c2b23631a5d1d7d9b7d93c4174b8eb1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/3c17367e3c2b23631a5d1d7d9b7d93c4174b8eb1"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-xjpv-cwpw-7qx8",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Authenticated IDOR in the data-import API exposes other users\u0027 imported rows (`row_data`/`data`) and column mappings"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61747",
"datePublished": "2026-09-21T18:44:15.662Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-21T20:05:00.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61746 (GCVE-0-2026-61746)
Vulnerability from nvd – Published: 2026-09-21 18:46 – Updated: 2026-09-21 19:06
VLAI
EPSS
VEX
Title
InvenTree: Plugin-settings GET endpoints are readable without authentication
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:05 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12168 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/6c1… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61746",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:05:53.635224Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:06:42.269Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:46:25.292Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12168"
},
{
"name": "https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-45f6-v6jq-99f7",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Plugin-settings GET endpoints are readable without authentication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61746",
"datePublished": "2026-09-21T18:46:25.292Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-21T19:06:42.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61744 (GCVE-0-2026-61744)
Vulnerability from nvd – Published: 2026-09-21 18:45 – Updated: 2026-09-29 15:07
VLAI
EPSS
VEX
Title
InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 15:07 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12233 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/f21… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:07:03.974809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:07:12.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller\u0027s per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:45:38.373Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12233",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12233"
},
{
"name": "https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-6pm3-m334-mr4j",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model\u0027s view role"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61744",
"datePublished": "2026-09-21T18:45:38.373Z",
"dateReserved": "2026-07-10T18:59:00.047Z",
"dateUpdated": "2026-09-29T15:07:12.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61745 (GCVE-0-2026-61745)
Vulnerability from nvd – Published: 2026-09-21 17:52 – Updated: 2026-09-21 18:35
VLAI
EPSS
VEX
Title
InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12197 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/29b… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61745",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:35:16.043466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:35:40.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:52:39.111Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12197",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12197"
},
{
"name": "https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-c9wp-mw98-gfrj",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61745",
"datePublished": "2026-09-21T17:52:39.111Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-21T18:35:40.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-39362 (GCVE-0-2026-39362)
Vulnerability from nvd – Published: 2026-04-08 19:32 – Updated: 2026-04-10 20:44
VLAI
EPSS
VEX
Title
InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 20:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-39362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T20:43:57.761676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T20:44:13.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django\u0027s URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:32:46.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m9j7-jw3m-fr22",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m9j7-jw3m-fr22"
}
],
"source": {
"advisory": "GHSA-m9j7-jw3m-fr22",
"discovery": "UNKNOWN"
},
"title": "InvenTree has SSRF via Remote Image Download \u2014 No IP/Hostname Validation on remote_image URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-39362",
"datePublished": "2026-04-08T19:32:46.744Z",
"dateReserved": "2026-04-06T21:29:17.349Z",
"dateUpdated": "2026-04-10T20:44:13.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35479 (GCVE-0-2026-35479)
Vulnerability from nvd – Published: 2026-04-08 19:27 – Updated: 2026-04-09 14:16
VLAI
EPSS
VEX
Title
InvenTree Plugin Installation - Insufficient Permissions
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-09 14:16 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://docs.inventree.org/en/stable/concepts/thr… | x_refsource_MISC |
| https://docs.inventree.org/en/stable/start/config… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-09T14:16:28.170445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T14:16:36.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring \"superuser\" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:27:57.320Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7"
},
{
"name": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust"
},
{
"name": "https://docs.inventree.org/en/stable/start/config/#plugin-options",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.inventree.org/en/stable/start/config/#plugin-options"
}
],
"source": {
"advisory": "GHSA-7c3q-vwcv-2vp7",
"discovery": "UNKNOWN"
},
"title": "InvenTree Plugin Installation - Insufficient Permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35479",
"datePublished": "2026-04-08T19:27:57.320Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-09T14:16:36.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35478 (GCVE-0-2026-35478)
Vulnerability from nvd – Published: 2026-04-08 19:24 – Updated: 2026-04-08 20:12
VLAI
EPSS
VEX
Title
InvenTree has Arbitrary API Token Creation
Summary
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 20:11 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T20:11:59.356333Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T20:12:15.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.16.0, \u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system \u2014 including administrators and superusers \u2014 by supplying the target\u0027s user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:24:05.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg"
}
],
"source": {
"advisory": "GHSA-qh5j-c28q-c4rg",
"discovery": "UNKNOWN"
},
"title": "InvenTree has Arbitrary API Token Creation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35478",
"datePublished": "2026-04-08T19:24:05.044Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-08T20:12:15.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35477 (GCVE-0-2026-35477)
Vulnerability from nvd – Published: 2026-04-08 19:20 – Updated: 2026-04-10 20:43
VLAI
EPSS
VEX
Title
InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape
Summary
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 20:43 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T20:43:01.777985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T20:43:12.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.2.3, \u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:20:58.967Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq"
}
],
"source": {
"advisory": "GHSA-84jh-x777-8pqq",
"discovery": "UNKNOWN"
},
"title": "InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35477",
"datePublished": "2026-04-08T19:20:58.967Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-10T20:43:12.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35476 (GCVE-0-2026-35476)
Vulnerability from nvd – Published: 2026-04-08 19:26 – Updated: 2026-04-08 19:53
VLAI
EPSS
VEX
Title
InvenTree Affected by Privilege Escalation via API
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 19:53 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://docs.inventree.org/en/stable/concepts/thr… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T19:53:23.187630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:53:28.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:26:12.692Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2"
},
{
"name": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust"
}
],
"source": {
"advisory": "GHSA-r8q5-3595-3jh2",
"discovery": "UNKNOWN"
},
"title": "InvenTree Affected by Privilege Escalation via API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35476",
"datePublished": "2026-04-08T19:26:12.692Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-08T19:53:28.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33531 (GCVE-0-2026-33531)
Vulnerability from nvd – Published: 2026-03-26 19:40 – Updated: 2026-03-27 19:47
VLAI
EPSS
VEX
Title
InvenTree has Path Traversal In Report Templates
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 19:46 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/11579 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33531",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T19:46:51.984002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T19:47:03.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T19:40:50.787Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769"
},
{
"name": "https://github.com/inventree/InvenTree/pull/11579",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/11579"
}
],
"source": {
"advisory": "GHSA-rhc5-7c3r-c769",
"discovery": "UNKNOWN"
},
"title": "InvenTree has Path Traversal In Report Templates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33531",
"datePublished": "2026-03-26T19:40:50.787Z",
"dateReserved": "2026-03-20T18:05:11.830Z",
"dateUpdated": "2026-03-27T19:47:03.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33530 (GCVE-0-2026-33530)
Vulnerability from nvd – Published: 2026-03-26 19:34 – Updated: 2026-03-30 11:24
VLAI
EPSS
VEX
Title
InvenTree Vulnerable to ORM Filter Injection
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 11:24 UTC
CWE
- CWE-202 - Exposure of Sensitive Information Through Data Queries
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/11581 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T11:24:21.708647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T11:24:37.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django\u0027s ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django\u0027s __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-202",
"description": "CWE-202: Exposure of Sensitive Information Through Data Queries",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T19:34:51.294Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg"
},
{
"name": "https://github.com/inventree/InvenTree/pull/11581",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/11581"
}
],
"source": {
"advisory": "GHSA-m8j2-vfmq-p6qg",
"discovery": "UNKNOWN"
},
"title": "InvenTree Vulnerable to ORM Filter Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33530",
"datePublished": "2026-03-26T19:34:51.294Z",
"dateReserved": "2026-03-20T18:05:11.830Z",
"dateUpdated": "2026-03-30T11:24:37.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27629 (GCVE-0-2026-27629)
Vulnerability from nvd – Published: 2026-02-25 02:48 – Updated: 2026-02-26 21:33
VLAI
EPSS
VEX
Title
InvenTree Vulnerable to Server Side Template Injection (SSTI)
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified by a staff user to exfiltrate sensitive information or perform code execution on the server. This issue requires access by a user with granted staff permissions, followed by a request to generate a custom batch code via the API. Once the template has been modified in a malicious manner, the API call to generate a new batch code could be made by other users, and the template code will be executed with their user context. The code has been patched to ensure that all template generation is performed within a secure sandboxed context. This issue has been addressed in version 1.2.3, and any versions from 1.3.0 onwards. Some workarounds are available. The batch code template is a configurable global setting which can be adjusted via any user with staff access. To prevent this setting from being edited, it can be overridden at a system level to a default value, preventing it from being edited. This requires system administrator access, and cannot be changed from the client side once the server is running. It is recommended that for InvenTree installations prior to 1.2.3 the `STOCK_BATCH_CODE_TEMPLATE` and `PART_NAME_FORMAT` global settings are overridden at the system level to prevent editing.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 21:06 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T21:06:58.547845Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T21:33:40.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified by a staff user to exfiltrate sensitive information or perform code execution on the server. This issue requires access by a user with granted staff permissions, followed by a request to generate a custom batch code via the API. Once the template has been modified in a malicious manner, the API call to generate a new batch code could be made by other users, and the template code will be executed with their user context. The code has been patched to ensure that all template generation is performed within a secure sandboxed context. This issue has been addressed in version 1.2.3, and any versions from 1.3.0 onwards. Some workarounds are available. The batch code template is a configurable global setting which can be adjusted via any user with staff access. To prevent this setting from being edited, it can be overridden at a system level to a default value, preventing it from being edited. This requires system administrator access, and cannot be changed from the client side once the server is running. It is recommended that for InvenTree installations prior to 1.2.3 the `STOCK_BATCH_CODE_TEMPLATE` and `PART_NAME_FORMAT` global settings are overridden at the system level to prevent editing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T02:48:41.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-cx85-vr3q-9x4m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-cx85-vr3q-9x4m"
}
],
"source": {
"advisory": "GHSA-cx85-vr3q-9x4m",
"discovery": "UNKNOWN"
},
"title": "InvenTree Vulnerable to Server Side Template Injection (SSTI)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27629",
"datePublished": "2026-02-25T02:48:41.934Z",
"dateReserved": "2026-02-20T22:02:30.028Z",
"dateUpdated": "2026-02-26T21:33:40.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-49000 (GCVE-0-2025-49000)
Vulnerability from nvd – Published: 2025-06-03 20:54 – Updated: 2025-06-04 13:49
VLAI
EPSS
VEX
Title
InvenTree has uncontrolled memory allocation via built-in label-sheet plugin
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-04 13:49 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/commit/082… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-49000",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-04T13:49:23.265294Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-04T13:49:33.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 0.17.13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T20:54:27.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6"
},
{
"name": "https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/0.17.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/0.17.13"
}
],
"source": {
"advisory": "GHSA-m2ch-h84r-p9r6",
"discovery": "UNKNOWN"
},
"title": "InvenTree has uncontrolled memory allocation via built-in label-sheet plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-49000",
"datePublished": "2025-06-03T20:54:27.744Z",
"dateReserved": "2025-05-29T16:34:07.174Z",
"dateUpdated": "2025-06-04T13:49:33.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-61748 (GCVE-0-2026-61748)
Vulnerability from cvelistv5 – Published: 2026-09-21 18:47 – Updated: 2026-09-24 22:30
VLAI
EPSS
VEX
Title
InvenTree: Report/Label print endpoints ignore per-model permissions
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 22:30 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12142 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/73b… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61748",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T22:30:13.197826Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T22:30:22.380Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller\u0027s per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:47:14.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12142",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12142"
},
{
"name": "https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-7w96-99fj-8g7x",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Report/Label print endpoints ignore per-model permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61748",
"datePublished": "2026-09-21T18:47:14.044Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-24T22:30:22.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61746 (GCVE-0-2026-61746)
Vulnerability from cvelistv5 – Published: 2026-09-21 18:46 – Updated: 2026-09-21 19:06
VLAI
EPSS
VEX
Title
InvenTree: Plugin-settings GET endpoints are readable without authentication
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
Severity
5.3 (Medium)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:05 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12168 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/6c1… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61746",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:05:53.635224Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:06:42.269Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:46:25.292Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12168",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12168"
},
{
"name": "https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-45f6-v6jq-99f7",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Plugin-settings GET endpoints are readable without authentication"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61746",
"datePublished": "2026-09-21T18:46:25.292Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-21T19:06:42.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61744 (GCVE-0-2026-61744)
Vulnerability from cvelistv5 – Published: 2026-09-21 18:45 – Updated: 2026-09-29 15:07
VLAI
EPSS
VEX
Title
InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 15:07 UTC
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12233 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/f21… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T15:07:03.974809Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T15:07:12.160Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller\u0027s per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:45:38.373Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12233",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12233"
},
{
"name": "https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-6pm3-m334-mr4j",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model\u0027s view role"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61744",
"datePublished": "2026-09-21T18:45:38.373Z",
"dateReserved": "2026-07-10T18:59:00.047Z",
"dateUpdated": "2026-09-29T15:07:12.160Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61747 (GCVE-0-2026-61747)
Vulnerability from cvelistv5 – Published: 2026-09-21 18:44 – Updated: 2026-09-21 20:05
VLAI
EPSS
VEX
Title
InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 20:04 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12169 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/3c1… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T20:04:50.434899Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:05:00.096Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user\u0027s import session identifier and retrieve that session\u0027s row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:44:15.662Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12169",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12169"
},
{
"name": "https://github.com/inventree/InvenTree/commit/3c17367e3c2b23631a5d1d7d9b7d93c4174b8eb1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/3c17367e3c2b23631a5d1d7d9b7d93c4174b8eb1"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-xjpv-cwpw-7qx8",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Authenticated IDOR in the data-import API exposes other users\u0027 imported rows (`row_data`/`data`) and column mappings"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61747",
"datePublished": "2026-09-21T18:44:15.662Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-21T20:05:00.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61749 (GCVE-0-2026-61749)
Vulnerability from cvelistv5 – Published: 2026-09-21 18:31 – Updated: 2026-09-24 22:29
VLAI
EPSS
VEX
Title
InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 22:29 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12160 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/2b4… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61749",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T22:29:08.431867Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T22:29:20.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:31:54.532Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12160",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12160"
},
{
"name": "https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-568x-qh23-wh8g",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61749",
"datePublished": "2026-09-21T18:31:54.532Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-24T22:29:20.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-61745 (GCVE-0-2026-61745)
Vulnerability from cvelistv5 – Published: 2026-09-21 17:52 – Updated: 2026-09-21 18:35
VLAI
EPSS
VEX
Title
InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.
Severity
4.3 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/12197 | x_refsource_MISC |
| https://github.com/inventree/InvenTree/commit/29b… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-61745",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:35:16.043466Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:35:40.123Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T17:52:39.111Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj"
},
{
"name": "https://github.com/inventree/InvenTree/pull/12197",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/12197"
},
{
"name": "https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/1.4.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/1.4.0"
}
],
"source": {
"advisory": "GHSA-c9wp-mw98-gfrj",
"discovery": "UNKNOWN"
},
"title": "InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-61745",
"datePublished": "2026-09-21T17:52:39.111Z",
"dateReserved": "2026-07-10T18:59:00.048Z",
"dateUpdated": "2026-09-21T18:35:40.123Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-39362 (GCVE-0-2026-39362)
Vulnerability from cvelistv5 – Published: 2026-04-08 19:32 – Updated: 2026-04-10 20:44
VLAI
EPSS
VEX
Title
InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django's URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 20:43 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-39362",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T20:43:57.761676Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T20:44:13.278Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, when INVENTREE_DOWNLOAD_FROM_URL is enabled (opt-in), authenticated users can supply remote_image URLs that are fetched server-side via requests.get() with only Django\u0027s URLValidator check. There is no validation against private IP ranges or internal hostnames. Redirects are followed (allow_redirects=True), enabling bypass of any URL-format checks. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:32:46.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m9j7-jw3m-fr22",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m9j7-jw3m-fr22"
}
],
"source": {
"advisory": "GHSA-m9j7-jw3m-fr22",
"discovery": "UNKNOWN"
},
"title": "InvenTree has SSRF via Remote Image Download \u2014 No IP/Hostname Validation on remote_image URLs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-39362",
"datePublished": "2026-04-08T19:32:46.744Z",
"dateReserved": "2026-04-06T21:29:17.349Z",
"dateUpdated": "2026-04-10T20:44:13.278Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35479 (GCVE-0-2026-35479)
Vulnerability from cvelistv5 – Published: 2026-04-08 19:27 – Updated: 2026-04-09 14:16
VLAI
EPSS
VEX
Title
InvenTree Plugin Installation - Insufficient Permissions
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-09 14:16 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://docs.inventree.org/en/stable/concepts/thr… | x_refsource_MISC |
| https://docs.inventree.org/en/stable/start/config… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35479",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-09T14:16:28.170445Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-09T14:16:36.423Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring \"superuser\" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:27:57.320Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7"
},
{
"name": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust"
},
{
"name": "https://docs.inventree.org/en/stable/start/config/#plugin-options",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.inventree.org/en/stable/start/config/#plugin-options"
}
],
"source": {
"advisory": "GHSA-7c3q-vwcv-2vp7",
"discovery": "UNKNOWN"
},
"title": "InvenTree Plugin Installation - Insufficient Permissions"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35479",
"datePublished": "2026-04-08T19:27:57.320Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-09T14:16:36.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35476 (GCVE-0-2026-35476)
Vulnerability from cvelistv5 – Published: 2026-04-08 19:26 – Updated: 2026-04-08 19:53
VLAI
EPSS
VEX
Title
InvenTree Affected by Privilege Escalation via API
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 19:53 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://docs.inventree.org/en/stable/concepts/thr… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35476",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T19:53:23.187630Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:53:28.982Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:26:12.692Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2"
},
{
"name": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust",
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust"
}
],
"source": {
"advisory": "GHSA-r8q5-3595-3jh2",
"discovery": "UNKNOWN"
},
"title": "InvenTree Affected by Privilege Escalation via API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35476",
"datePublished": "2026-04-08T19:26:12.692Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-08T19:53:28.982Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35478 (GCVE-0-2026-35478)
Vulnerability from cvelistv5 – Published: 2026-04-08 19:24 – Updated: 2026-04-08 20:12
VLAI
EPSS
VEX
Title
InvenTree has Arbitrary API Token Creation
Summary
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
8.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-08 20:11 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35478",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-08T20:11:59.356333Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T20:12:15.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003e= 0.16.0, \u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system \u2014 including administrators and superusers \u2014 by supplying the target\u0027s user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:24:05.044Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg"
}
],
"source": {
"advisory": "GHSA-qh5j-c28q-c4rg",
"discovery": "UNKNOWN"
},
"title": "InvenTree has Arbitrary API Token Creation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35478",
"datePublished": "2026-04-08T19:24:05.044Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-08T20:12:15.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-35477 (GCVE-0-2026-35477)
Vulnerability from cvelistv5 – Published: 2026-04-08 19:20 – Updated: 2026-04-10 20:43
VLAI
EPSS
VEX
Title
InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape
Summary
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-10 20:43 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-35477",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-10T20:43:01.777985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-10T20:43:12.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.2.3, \u003c 1.2.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed jinja2.Environment. Additionally, the validator uses a dummy Part instance with pk=None, which allows conditional template expressions to behave differently during validation versus production rendering. A staff user with settings access can craft a template that passes validation but executes arbitrary code during rendering. This issue requires access by a user with granted staff permissions. This vulnerability is fixed in 1.2.7 and 1.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T19:20:58.967Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-84jh-x777-8pqq"
}
],
"source": {
"advisory": "GHSA-84jh-x777-8pqq",
"discovery": "UNKNOWN"
},
"title": "InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-35477",
"datePublished": "2026-04-08T19:20:58.967Z",
"dateReserved": "2026-04-02T20:49:44.453Z",
"dateUpdated": "2026-04-10T20:43:12.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33531 (GCVE-0-2026-33531)
Vulnerability from cvelistv5 – Published: 2026-03-26 19:40 – Updated: 2026-03-27 19:47
VLAI
EPSS
VEX
Title
InvenTree has Path Traversal In Report Templates
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-27 19:46 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/11579 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33531",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-27T19:46:51.984002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-27T19:47:03.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T19:40:50.787Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-rhc5-7c3r-c769"
},
{
"name": "https://github.com/inventree/InvenTree/pull/11579",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/11579"
}
],
"source": {
"advisory": "GHSA-rhc5-7c3r-c769",
"discovery": "UNKNOWN"
},
"title": "InvenTree has Path Traversal In Report Templates"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33531",
"datePublished": "2026-03-26T19:40:50.787Z",
"dateReserved": "2026-03-20T18:05:11.830Z",
"dateUpdated": "2026-03-27T19:47:03.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33530 (GCVE-0-2026-33530)
Vulnerability from cvelistv5 – Published: 2026-03-26 19:34 – Updated: 2026-03-30 11:24
VLAI
EPSS
VEX
Title
InvenTree Vulnerable to ORM Filter Injection
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 11:24 UTC
CWE
- CWE-202 - Exposure of Sensitive Information Through Data Queries
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/pull/11581 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33530",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T11:24:21.708647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T11:24:37.542Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django\u0027s ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django\u0027s __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-202",
"description": "CWE-202: Exposure of Sensitive Information Through Data Queries",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-26T19:34:51.294Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg"
},
{
"name": "https://github.com/inventree/InvenTree/pull/11581",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/pull/11581"
}
],
"source": {
"advisory": "GHSA-m8j2-vfmq-p6qg",
"discovery": "UNKNOWN"
},
"title": "InvenTree Vulnerable to ORM Filter Injection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-33530",
"datePublished": "2026-03-26T19:34:51.294Z",
"dateReserved": "2026-03-20T18:05:11.830Z",
"dateUpdated": "2026-03-30T11:24:37.542Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-27629 (GCVE-0-2026-27629)
Vulnerability from cvelistv5 – Published: 2026-02-25 02:48 – Updated: 2026-02-26 21:33
VLAI
EPSS
VEX
Title
InvenTree Vulnerable to Server Side Template Injection (SSTI)
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified by a staff user to exfiltrate sensitive information or perform code execution on the server. This issue requires access by a user with granted staff permissions, followed by a request to generate a custom batch code via the API. Once the template has been modified in a malicious manner, the API call to generate a new batch code could be made by other users, and the template code will be executed with their user context. The code has been patched to ensure that all template generation is performed within a secure sandboxed context. This issue has been addressed in version 1.2.3, and any versions from 1.3.0 onwards. Some workarounds are available. The batch code template is a configurable global setting which can be adjusted via any user with staff access. To prevent this setting from being edited, it can be overridden at a system level to a default value, preventing it from being edited. This requires system administrator access, and cannot be changed from the client side once the server is running. It is recommended that for InvenTree installations prior to 1.2.3 the `STOCK_BATCH_CODE_TEMPLATE` and `PART_NAME_FORMAT` global settings are overridden at the system level to prevent editing.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-26 21:06 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-27629",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-26T21:06:58.547845Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T21:33:40.971Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 1.2.3"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified by a staff user to exfiltrate sensitive information or perform code execution on the server. This issue requires access by a user with granted staff permissions, followed by a request to generate a custom batch code via the API. Once the template has been modified in a malicious manner, the API call to generate a new batch code could be made by other users, and the template code will be executed with their user context. The code has been patched to ensure that all template generation is performed within a secure sandboxed context. This issue has been addressed in version 1.2.3, and any versions from 1.3.0 onwards. Some workarounds are available. The batch code template is a configurable global setting which can be adjusted via any user with staff access. To prevent this setting from being edited, it can be overridden at a system level to a default value, preventing it from being edited. This requires system administrator access, and cannot be changed from the client side once the server is running. It is recommended that for InvenTree installations prior to 1.2.3 the `STOCK_BATCH_CODE_TEMPLATE` and `PART_NAME_FORMAT` global settings are overridden at the system level to prevent editing."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-25T02:48:41.934Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-cx85-vr3q-9x4m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-cx85-vr3q-9x4m"
}
],
"source": {
"advisory": "GHSA-cx85-vr3q-9x4m",
"discovery": "UNKNOWN"
},
"title": "InvenTree Vulnerable to Server Side Template Injection (SSTI)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-27629",
"datePublished": "2026-02-25T02:48:41.934Z",
"dateReserved": "2026-02-20T22:02:30.028Z",
"dateUpdated": "2026-02-26T21:33:40.971Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-49000 (GCVE-0-2025-49000)
Vulnerability from cvelistv5 – Published: 2025-06-03 20:54 – Updated: 2025-06-04 13:49
VLAI
EPSS
VEX
Title
InvenTree has uncontrolled memory allocation via built-in label-sheet plugin
Summary
InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-04 13:49 UTC
CWE
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/inventree/InvenTree/security/a… | x_refsource_CONFIRM |
| https://github.com/inventree/InvenTree/commit/082… | x_refsource_MISC |
| https://github.com/inventree/InvenTree/releases/t… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-49000",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-04T13:49:23.265294Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-04T13:49:33.402Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "InvenTree",
"vendor": "inventree",
"versions": [
{
"status": "affected",
"version": "\u003c 0.17.13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T20:54:27.744Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-m2ch-h84r-p9r6"
},
{
"name": "https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/commit/0826a75ef6dde0ad96d680f52a9cf171ba2ce98b"
},
{
"name": "https://github.com/inventree/InvenTree/releases/tag/0.17.13",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/inventree/InvenTree/releases/tag/0.17.13"
}
],
"source": {
"advisory": "GHSA-m2ch-h84r-p9r6",
"discovery": "UNKNOWN"
},
"title": "InvenTree has uncontrolled memory allocation via built-in label-sheet plugin"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-49000",
"datePublished": "2025-06-03T20:54:27.744Z",
"dateReserved": "2025-05-29T16:34:07.174Z",
"dateUpdated": "2025-06-04T13:49:33.402Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}