CVE-2026-61746 Details
Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
A vulnerability in InvenTree's plugin settings API endpoints allows unauthenticated users to access sensitive metadata and non-protected configuration values. This issue affects InvenTree versions prior to 1.4.0. The vulnerability arises because certain endpoints bypass authentication checks, exposing plugin names, setting keys, descriptions, types, choices, and non-secret configuration values. While protected secret values are masked, this vulnerability still leads to unauthorized access to metadata and non-sensitive configuration details.
Users can update to InvenTree version 1.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0 | [email protected] | Source CodeVendor |
| https://github.com/inventree/InvenTree/pull/12168 | [email protected] | Issue TrackingVendor |
| https://github.com/inventree/InvenTree/releases/tag/1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvenTree | <= 1.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |