CVE-2026-61746mediumCWE-200CWE-862

CVE-2026-61746: fallo de gravedad media en InvenTree

InvenTree: Plugin-settings GET endpoints are readable without authentication

Publicada el

Seguir esta CVE+ Monitorear InvenTree

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
inventree · InvenTree
CVEs relacionadas — InvenTree

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-61744MEDIUMInvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleEPSS 0.5%CVE-2026-61749MEDIUMInvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential DisclosureEPSS 0.5%CVE-2026-61745MEDIUMInvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipmentEPSS 0.4%CVE-2026-61748MEDIUMInvenTree: Report/Label print endpoints ignore per-model permissionsEPSS 0.4%CVE-2025-49000LOWInvenTree has uncontrolled memory allocation via built-in label-sheet pluginEPSS 0.4%CVE-2026-61747MEDIUMInvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappingsEPSS 0.3%