InvenTree CVE-2026-61745

Requires a valid authenticated InvenTree account of any privilege level below ADMIN (the advisory names a STOCK-only warehouse user as sufficient) and at least one registered machine in the system (InvenTree machine integrations such as label printers or barcode scanners must be configured). Exploitation is a single authenticated POST to /api/machine/{pk}/restart/ against InvenTree versions prior to 1.4.0; the attacker must know or enumerate the target machine's pk. Limiting factors: authentication is mandatory (not remote-unauthenticated), impact is confined to availability/disruption of machine operations with no data exposure or modification, and deployments with no registered machines have no exploitable surface.

This is a genuine but low-severity issue, correctly scored. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, 4.3 MEDIUM) is internally consistent with the description and the confirming source-code fix, and I concur with it: the flaw is a missing-authorization (CWE-862) availability-only weakness - no confidentiality or integrity impact, just the ability to restart/reset registered machines and interrupt their operations. Exploitation requires an authenticated account (PR:L), so the blast radius is limited to insiders or attackers who already hold valid low-privilege credentials (e.g. a STOCK-role warehouse user). There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so the exploitation status is 'no public exploit identified.' No SSVC decision data was provided. Signals are aligned rather than conflicting - modest CVSS, availability-only impact, authentication gate, and no exploitation evidence all point the same direction. Net: patch during normal maintenance rather than as an emergency; it is a real authorization gap but a low real-world priority, especially since the only impact is transient disruption of machine operations that can be re-triggered by an operator.

A warehouse employee holding only a low-privilege InvenTree account (e.g. STOCK role, no ADMIN) discovers a registered machine's primary key and sends POST /api/machine/{pk}/restart/. The server invokes registry.restart_machine() without checking for staff/ADMIN privileges, resetting the machine's status and interrupting any active label printing, barcode scanning, or other operation. No public exploit code exists, but the request is trivial and requires only low-complexity network access with valid low-privilege credentials.