Inventree CVE-2026-35479

CVSS 6.6 with PR:H (high privilege required) and AV:N (network-accessible API) indicates moderate-to-high risk conditional on attacker holding staff privileges. The CVSS vector explicitly requires authenticated high-privilege access (PR:H), meaning only staff users or higher can exploit this; low-privilege or unauthenticated users cannot. The attack is straightforward (AC:L), has network scope (S:C), and causes confidentiality, integrity, and availability impact (C:L, I:L, A:L)-consistent with arbitrary code execution via malicious plugin installation. Real-world risk depends critically on organizational trust model: if staff accounts are issued to contractors, vendors, or junior administrators with lower vetting than superusers, the risk is substantial. If staff is tightly controlled and all staff users are fully trusted, risk is lower. The inconsistent permission enforcement (staff can install but not uninstall) signals a logic error rather than intentional design, increasing likelihood of exploitability. No active exploitation or public POC has been identified, but the ease of API-based exploitation (no complex interaction required) and the availability of detailed advisory documentation make development of POC straightforward for motivated insiders.

A staff-level user (e.g., a contractor with warehouse management privileges) authenticates to the InvenTree API and makes an HTTP POST request to the plugin installation endpoint with a malicious plugin package URL. The unpatched API, failing to verify superuser status, accepts and installs the plugin. The plugin executes with InvenTree application privileges, allowing the attacker to exfiltrate inventory data, modify stock records, or pivot to internal systems. Because plugin installation can be performed entirely via API with no UI interaction (UI:N), the attack requires no additional social engineering.