What is the CVSS score of CVE-2026-35476?

CVE-2026-35476 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Inventree are affected by CVE-2026-35476?

InvenTree inventory management system versions before 1.2.7 and 1.3.0 contain a privilege escalation vulnerability in API endpoints that allows unauthenticated attackers to grant staff-level…. A patch is available.

How to fix or mitigate CVE-2026-35476?

Within 24 hours: Identify all InvenTree deployments and document current versions. Within 7 days: Upgrade InvenTree to version 1.2.7 or 1.3.0 or later in non-production environments first. Within 30 days: Complete production upgrades and validate API endpoint access controls are functioning correctly post-patch.

Inventree CVE-2026-35476

EUVD-2026-20586 HIGH

Improper Authorization (CWE-285)

2026-04-08 security-advisories@github.com

Authentication Bypass Inventree

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 21, 2026 - 13:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 21, 2026 - 13:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.7

EUVD ID Assigned

Apr 08, 2026 - 20:23 euvd

EUVD-2026-20586

Analysis Generated

Apr 08, 2026 - 20:23 vuln.today

CVE Published

Apr 08, 2026 - 20:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

AnalysisAI

Privilege escalation in InvenTree inventory management system versions prior to 1.2.7 and 1.3.0 allows remote unauthenticated attackers to elevate any user account to staff level through improperly secured API endpoints. Exploitation requires no special conditions beyond network access and enables unauthorized administrative access to inventory management functions. EPSS score of 0.03% (8th percentile) indicates low observed exploitation likelihood, and SSVC assessment confirms no known exploitation with non-automatable attack requiring user account creation first.

Technical ContextAI

InvenTree is an open-source inventory management platform built with Django and Django REST Framework. This vulnerability stems from CWE-285 (Improper Authorization), specifically inadequate access controls on user account modification API endpoints. The REST API framework's permission classes were misconfigured to allow write operations on the user profile endpoint without proper staff-level authorization checks. This architectural flaw permits POST requests containing privilege escalation payloads to succeed when they should be restricted to existing staff accounts or system administrators. The vulnerability affects the user serializer and view logic that handles account attribute updates, where the 'is_staff' boolean field modification was not properly gated behind administrative permission validators.

RemediationAI

Upgrade immediately to InvenTree version 1.2.7 or 1.3.0, both confirmed patched releases per GitHub security advisory GHSA-r8q5-3595-3jh2. Organizations running 1.2.x stable branch should update to 1.2.7; those on 1.3.x development track should update to 1.3.0 or later. Follow upgrade procedures at vendor documentation and verify user permission configurations post-upgrade. If immediate patching is not feasible, implement network-level access controls restricting API endpoint access to trusted IP ranges and deploy a reverse proxy (nginx, Apache) with request filtering rules to block PUT/POST/PATCH requests to /api/user/{id}/ endpoints from non-administrative source addresses - this workaround introduces operational overhead requiring whitelist maintenance for legitimate administrative access and may break mobile applications or distributed workflows. Additionally, conduct immediate audit of user accounts for unauthorized staff privilege assignments using Django admin interface or database queries against auth_user table filtering is_staff=true, revoking elevated privileges from accounts created or modified within vulnerable window. Note that access control workarounds do not address the underlying authorization flaw and should be considered temporary compensating controls only.