InvenTree CVE-2026-61747

Requires a valid authenticated account on the InvenTree instance - but notably any account works, including one with no assigned roles, because the DataImporterPermissionMixin did not scope DataImportRow/DataImportColumnMap querysets to the DataImportSession owner. The attacker must know or enumerate another user's import session identifier and target the /api/importer/row/ or /api/importer/mapping/ endpoints. Exploitation is limited to instances running versions prior to 1.4.0 that have concurrent multi-user import activity (there must be another user's staged import data present to steal), and the vendor explicitly treats authenticated users as trusted, so the practical exposure is between distrustful co-tenants of the same instance rather than against outsiders. No user interaction or elevated privilege is needed beyond basic authentication.

This is a low-severity broken-object-level-authorization flaw (CWE-639 IDOR) that the vendor rates 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and that rating is well-supported: the impact is confidentiality-only (C:L), with no integrity or availability effect, and exploitation requires an authenticated account (PR:L). No EPSS score, no CISA KEV listing, and no public POC were provided, so the exploitation status is 'no public exploit identified at time of analysis.' All signals are consistent and point to LOW real-world priority rather than a high-CVSS-but-overstated issue - in fact the reverse: the CVSS is already low and matches the technical reality. A key mitigating nuance stated explicitly in the advisory is that the InvenTree threat model treats all authenticated instance users as trusted, meaning this is a defense-in-depth hardening fix rather than a boundary breach of an untrusted principal. The 'Authentication Bypass' tag is misleading - nothing is bypassed; an already-authenticated user reads objects they should not be scoped to, which is an authorization (access-control) failure. No conflicting signals between the CVSS vector and the description: both describe authenticated network access.

An authenticated InvenTree user with no assigned roles enumerates or guesses another user's DataImportSession identifier and issues GET requests to /api/importer/row/ and /api/importer/mapping/ scoped to that session, retrieving the victim's staged row_data, data fields, and column mappings. Because querysets were not scoped to the session owner, the server returns the full contents of another user's staged import data. No public exploit code was identified at time of analysis, and exploitation is limited to accounts that already hold valid credentials on the instance.