CVE-2026-61744 Details
Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.
A vulnerability in InvenTree's barcode scanning API endpoint POST /api/barcode/ prior to version 1.4.0 allows low-privilege authenticated users to bypass role-based access controls and access sensitive inventory data. The issue arises because the endpoint does not enforce per-model view roles, enabling users to enumerate primary keys and retrieve full serialized object data for various inventory items, including parts, stock locations, and order details. This vulnerability could lead to unauthorized disclosure of commercially sensitive information such as pricing, supplier, and customer data.
Users should update to InvenTree version 1.4.0 or later, where this vulnerability has been fixed. After updating, ensure that the barcode scanning API enforces the same per-model view role permissions that are applied to other detail endpoints.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984 | [email protected] | Source CodeVendor |
| https://github.com/inventree/InvenTree/pull/12233 | [email protected] | Issue TrackingVendor |
| https://github.com/inventree/InvenTree/releases/tag/1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvenTree | <= 1.3.5 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |