CVE-2026-61748mediumCWE-639CWE-862

CVE-2026-61748: falha de média gravidade em InvenTree

InvenTree: Report/Label print endpoints ignore per-model permissions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar InvenTree

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
inventree · InvenTree
CVEs relacionadas — InvenTree

No mesmo produto, das mais perigosas para as menos.

CVE-2026-61744MEDIUMInvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view roleEPSS 0.5%CVE-2026-61749MEDIUMInvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential DisclosureEPSS 0.5%CVE-2026-61745MEDIUMInvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipmentEPSS 0.4%CVE-2026-61746MEDIUMInvenTree: Plugin-settings GET endpoints are readable without authenticationEPSS 0.4%CVE-2025-49000LOWInvenTree has uncontrolled memory allocation via built-in label-sheet pluginEPSS 0.4%CVE-2026-61747MEDIUMInvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappingsEPSS 0.3%