CVE-2026-61747 Details
Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.
A vulnerability exists in InvenTree, an open-source inventory management system, in versions prior to 1.4.0. The issue arises in the data-import API endpoints for rows and column mappings, which do not restrict access to the owner's data import session. This oversight allows any authenticated user, even those without assigned roles, to access another user's imported data and column mappings by providing the session ID. As a result, the vulnerability exposes the complete contents of the data being imported, creating a risk of unauthorized data access between users.
Users can update to InvenTree version 1.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/inventree/InvenTree/commit/3c17367e3c2b23631a5d1d7d9b7d93c4174b8eb1 | [email protected] | Source CodeVendor |
| https://github.com/inventree/InvenTree/pull/12169 | [email protected] | Issue TrackingVendor |
| https://github.com/inventree/InvenTree/releases/tag/1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvenTree | <= 1.3.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |