EUVD-2026-20586
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
Analysis
Privilege escalation in InvenTree Open Source Inventory Management System versions before 1.2.7 and 1.3.0 allows any authenticated user to elevate to staff-level permissions through improperly secured API endpoints. The vulnerability stems from misconfigured write permissions on user account endpoints, enabling unauthorized modification of staff status flags via POST requests. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Identify all InvenTree deployments and document current versions in use. Within 7 days: Upgrade to InvenTree 1.2.7 or 1.3.0 or later; if upgrades cannot be completed, restrict API access via network controls. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today