What is the CVSS score of CVE-2026-35478?

CVE-2026-35478 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of Inventree are affected by CVE-2026-35478?

InvenTree inventory management system versions 0.16.0 through 1.2.6 contain an authentication bypass vulnerability that allows any logged-in user to create API tokens for other users, including…. A patch is available.

How to fix or mitigate CVE-2026-35478?

Within 24 hours: Identify all InvenTree deployments and document current versions in use. Within 7 days: Apply vendor-released patch to upgrade all instances to version 1.2.7 or later; verify API token logs for unauthorized token creation activity during the vulnerability window. Within 30 days: Conduct full audit of API token usage and revoke any suspicious or unauthorized tokens; implement network-level API access logging and alerting.

Inventree CVE-2026-35478

EUVD-2026-20590 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-04-08 security-advisories@github.com

Authentication Bypass Inventree

8.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 20, 2026 - 15:22 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:01 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.7

EUVD ID Assigned

Apr 08, 2026 - 20:23 euvd

EUVD-2026-20590

Analysis Generated

Apr 08, 2026 - 20:23 vuln.today

CVE Published

Apr 08, 2026 - 20:16 nvd

HIGH 8.3

DescriptionGitHub Advisory

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system - including administrators and superusers - by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.

AnalysisAI

Authentication bypass in InvenTree open source inventory management system allows any authenticated user to generate API tokens for arbitrary users, including administrators, enabling complete account takeover. Affected versions 0.16.0 through 1.2.6 permit low-privileged users to forge API credentials by manipulating the user field in POST requests to /api/user/tokens/. Resulting tokens provide full API access from any network location without requiring victim interaction. No public exploit identified at time of analysis.

Technical ContextAI

Broken access control in token generation endpoint fails to validate user field parameter against authenticated session identity (CWE-639: Authorization Bypass Through User-Controlled Key). API endpoint accepts arbitrary user_id values in POST body, creating valid JWT or session tokens for targeted accounts without authorization checks, enabling horizontal and vertical privilege escalation through forged credential issuance.

RemediationAI

Vendor-released patch: upgrade immediately to InvenTree version 1.2.7 or 1.3.0, which enforce proper authorization checks preventing token generation for non-owned user accounts. No workaround exists for unpatched installations; applying the security update is mandatory. Organizations unable to upgrade immediately should restrict API access to trusted networks only and audit all API tokens created since version 0.16.0 deployment for unauthorized credential issuance. Revoke any tokens created by users other than the token owner. Full vendor security advisory available at https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg with additional technical details and remediation guidance.