What is the CVSS score of EUVD-2026-16359?

EUVD-2026-16359 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by EUVD-2026-16359?

InvenTree inventory management systems prior to version 1.2.6 allow authenticated users with low-level privileges to extract sensitive database information through unvalidated API filter parameters,…. A patch is available.

How to fix or mitigate EUVD-2026-16359?

Within 24 hours: Identify all InvenTree deployments and document current versions. Within 7 days: Upgrade InvenTree to version 1.2.6 or later (1.3.0 recommended for additional stability). Within 30 days: Conduct access review of bulk operation API endpoints and implement principle-of-least-privilege controls for database query permissions; monitor API logs for anomalous filter parameter usage prior to upgrade.

Python EUVD-2026-16359

| CVE-2026-33530 HIGH

Exposure of Sensitive Information Through Data Queries (CWE-202)

2026-03-26 GitHub_M

Python Information Disclosure

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:13 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.2.6

EUVD ID Assigned

Mar 26, 2026 - 20:00 euvd

EUVD-2026-16359

Analysis Generated

Mar 26, 2026 - 20:00 vuln.today

CVE Published

Mar 26, 2026 - 19:34 nvd

HIGH 7.7

DescriptionGitHub Advisory

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. /api/part/, /api/stock/, /api/order/so/allocation/, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

AnalysisAI

Authenticated attackers with low-level privileges can exfiltrate sensitive database information from InvenTree open source inventory management systems prior to version 1.2.6 by abusing unvalidated filter parameters in bulk operation API endpoints. The vulnerability enables blind boolean-based data extraction through Django ORM relationship traversal, achieving high confidentiality impact with changed scope per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (score 7.7). No public exploit identified at time of analysis, and vendor-released patches are available in versions 1.2.6 and 1.3.0.

Technical ContextAI

InvenTree (cpe:2.3:a:inventree:inventree) is a Python-based open source inventory management platform built on Django framework. The vulnerability stems from CWE-202 (Exposure of Sensitive Information to an Unauthorized Actor) where bulk operation API endpoints including /api/part/, /api/stock/, and /api/order/so/allocation/ accept user-supplied filters parameters that are passed directly to Django ORM's queryset.filter(**filters) method without field allowlisting or input validation. This design flaw enables exploitation of Django's double-underscore lookup syntax for relationship traversal, allowing attackers to construct arbitrary database queries that traverse foreign key relationships and extract data through timing-based or boolean-based blind inference techniques. The issue represents improper input validation at the ORM abstraction layer, where framework features intended for internal use become externally controllable attack vectors.

RemediationAI

Upgrade InvenTree to version 1.2.6 or version 1.3.0 or later to receive the vendor-released patch that implements field allowlisting for bulk operation API filter parameters (see vendor advisory at https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg and implementation at https://github.com/inventree/InvenTree/pull/11581). According to the advisory, no workarounds are available for unpatched versions. Organizations unable to immediately upgrade should implement network-level access controls to restrict API endpoint access to only trusted authenticated users, implement enhanced monitoring for anomalous API query patterns targeting bulk endpoints with complex filter parameters, and review user privilege assignments to ensure principle of least privilege. Apply standard defense-in-depth measures including web application firewall rules to detect repeated API calls with varying filter parameters indicative of blind data extraction attempts.