CVE-2026-61745: falha de média gravidade em InvenTree
InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.4%
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
inventree · InvenTreeCVEs relacionadas — InvenTree
No mesmo produto, das mais perigosas para as menos.
CVE-2026-61744MEDIUMInvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleEPSS 0.5%CVE-2026-61749MEDIUMInvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential DisclosureEPSS 0.5%CVE-2026-61748MEDIUMInvenTree: Report/Label print endpoints ignore per-model permissionsEPSS 0.4%CVE-2026-61746MEDIUMInvenTree: Plugin-settings GET endpoints are readable without authenticationEPSS 0.4%CVE-2025-49000LOWInvenTree has uncontrolled memory allocation via built-in label-sheet pluginEPSS 0.4%CVE-2026-61747MEDIUMInvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappingsEPSS 0.3%