InvenTree CVE-2026-61744

Requires an authenticated session as any low-privilege InvenTree user, OR possession of an API token carrying only a general read scope, because BarcodeView uses IsAuthenticatedOrReadScope; the attacker does NOT need the per-model view role for the target objects, which is the core flaw. The attacker must be able to reach POST /api/barcode/ over the network and submit an internal JSON barcode containing a lowercase model label and integer primary key. Limiting factors: exploitation is impossible without valid credentials or a read-scope token (no unauthenticated path), impact is read-only disclosure (no write or availability effect), and value depends on the instance holding sensitive pricing/supplier/customer/order data; affected only on versions prior to 1.4.0.

The vendor CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5, Medium) is internally consistent with the description and the fix diff: a network-reachable REST endpoint (AV:N), no special conditions beyond a low-privilege authenticated session (PR:L), and pure confidentiality impact (C:H, I:N, A:N) matching a read-only IDOR that discloses full serializer output for arbitrary object IDs. There is no EPSS score, no CISA KEV listing, and no public POC referenced - exploitation status is 'no public exploit identified at time of analysis.' The C:H rating is defensible because the enumeration spans commercially sensitive data across parts, stock, locations, supplier/manufacturer parts, orders, and builds, but real risk is bounded: it requires a valid authenticated account (or a general read scope token) on the target instance, so this is an insider/compromised-account or multi-tenant-leakage exposure rather than an internet-wide unauthenticated breach. This is a genuine but moderate-priority issue - a real broken-object-authorization flaw worth patching, not an over-inflated high-CVSS-but-low-real-risk item, yet not an emergency given the authentication gate and absence of any active-exploitation or POC signal. No signals conflict; the main caveat is that the C:H hinges on the sensitivity of the specific deployment's inventory data.

A low-privilege InvenTree user (or a holder of a general read-scope API token) who lacks per-model view roles crafts internal JSON barcodes of the form {model label, integer pk} and POSTs them to /api/barcode/, which resolves the object via model.objects.get(pk=...) and returns the complete serializer payload without checking the caller's per-model view role. By iterating primary keys, the attacker systematically dumps pricing, supplier, customer, and order records they should not see. No public exploit code is referenced, but the attack is trivial to script given the simple, deterministic barcode format.