CVE-2026-61748 Details
Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.
A vulnerability exists in InvenTree, an open-source inventory management system, in versions prior to 1.4.0. The issue arises in the ReportPrint and LabelPrint endpoints, which require authentication but fail to verify user permissions based on their assigned roles. This oversight allows users with no roles or unrelated roles to access and download sensitive business data, such as purchase and sales information, part details, and inventory data, by simply exploiting the print functionality with default templates. The vulnerability is exacerbated by the sequential nature of object identifiers, enabling easy enumeration of data.
Users can update to InvenTree version 1.4.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175 | [email protected] | Source CodeVendor |
| https://github.com/inventree/InvenTree/pull/12142 | [email protected] | Issue TrackingVendor |
| https://github.com/inventree/InvenTree/releases/tag/1.4.0 | [email protected] | Release NotesVendor |
| https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| InvenTree | <= 1.3.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |