What is the CVSS score of EUVD-2026-84057?

EUVD-2026-84057 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for EUVD-2026-84057?

Yes, a patch is available for EUVD-2026-84057. Update the affected software to the latest version immediately.

InvenTree EUVD-2026-84057

| CVE-2026-61746 MEDIUM

Information Exposure (CWE-200)

2026-09-21 GitHub_M

Python Information Disclosure Django Inventree

5.3

CVSS 3.1 · Vendor: GitHub_M

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach InvenTree API over network
Delivery

Send unauthenticated GET to /api/plugin/settings/
Exploit

Endpoint skips IsAuthenticated check
Execution

Enumerate plugin names/keys/config metadata
Impact

Use disclosed data for reconnaissance

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of InvenTree prior to 1.4.0. The affected endpoints (/api/plugin/settings/, per-plugin settings via PluginSettingList/PluginAllSettingList/PluginSettingDetail) are reachable by anonymous callers because GlobalSettingsPermissions permits safe methods and AuthRequiredMiddleware exempts /api/ paths. Limiting factors: only GET/safe-method reads are exposed (no modification), protected secret values remain masked as three asterisks so only metadata and non-secret config leak, and at least one plugin must be installed/active to yield meaningful plugin data. Impact is confined to information disclosure with no integrity or availability effect.
Impact	This is a genuinely unauthenticated information-disclosure flaw, but a low-severity one. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) is internally consistent with the description and the source code: PluginSettingList, PluginAllSettingList, and PluginSettingDetail were set to GlobalSettingsPermissions (which returns true for safe/GET methods) without the IsAuthenticated class used by sibling endpoints, and AuthRequiredMiddleware exempts /api/ paths - so an anonymous caller reaches the data. The fix diff (adding permissions.IsAuthenticated to each endpoint, API v506) confirms the root cause precisely. Confidentiality is correctly scored Low: only plugin names, setting keys, descriptions, types, choices, and non-secret config leak, while protected secrets stay masked as three asterisks (I:N/A:N are correct - no write or availability impact). No EPSS score, KEV entry, or public POC was supplied; absence of these signals plus the metadata-only impact means this is a real but low-priority hardening issue, not an urgent exploitation risk. No signals conflict - the network vector, low complexity, and no-auth requirement all align with the described anonymous /api/plugin/settings/ access.
Exploit ScenarioDerived	An attacker who can reach an InvenTree instance's HTTP(S) API - without any account - sends a GET to /api/plugin/settings/ or a per-plugin settings endpoint and receives the list of installed plugins along with their setting keys, descriptions, types, choices, and non-secret configuration values. This reconnaissance reveals the deployment's plugin footprint and configuration posture (secret values remain masked), aiding targeting of further attacks. No public POC or active exploitation was reported in the provided data.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 21, 2026

Unauthenticated information disclosure in InvenTree prior to 1.4.0 lets a remote caller retrieve plugin names, setting keys, descriptions, types, choices and non-secret configuration values through /api/plugin/settings/ and the per-plugin settings endpoints, because PluginSettingList, PluginAllSettingList and PluginSettingDetail registered GlobalSettingsPermissions without the IsAuthenticated permission used by equivalent global-settings endpoints. Exposure is confined to metadata and non-secret configuration: protected secret values remain masked as three asterisks, only safe methods are readable, and at least one plugin must be installed and active for the disclosure to be meaningful, so the practical impact is limited. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), confirming remote unauthenticated exploitation with low confidentiality impact and no integrity or availability effect; no public exploit identified at time of analysis.

RemediationAI

Vendor-released patch: InvenTree 1.4.0 (release tag https://github.com/inventree/InvenTree/releases/tag/1.4.0, via pull request https://github.com/inventree/InvenTree/pull/12168 and commit 6c18e6402005c0f105f88dfba4aaa11cf990a7e0); upgrade to that version or later, as detailed in advisory GHSA-45f6-v6jq-99f7. If upgrading is not immediately possible, the most direct compensating control is to block anonymous GET access to the plugin settings paths at a reverse proxy or API gateway (for example, deny requests without valid session or token credentials to /api/plugin/settings/ and per-plugin setting URLs, or require authentication for all /api/plugin/ paths overall); the trade-off is that legitimate anonymous clients or integrations that read plugin metadata will break, and path-based filtering must be maintained as route paths evolve. Reducing the attack surface by deactivating unused plugins lowers the amount of enumerable metadata but costs functionality and only mitigates rather than eliminates the flaw, since the underlying endpoints remain reachable for any plugin left active. Because protected secret values are already masked, credential rotation is not required for this specific issue, and no integrity or availability mitigations are needed given the read-only nature of the exposure.

Affected VersionsENISA

InvenTree < 1.4.0

Affected Packages

euvd inventree fix: 1.4.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

InvenTree's REST API is built on Django REST Framework, where view classes declare permission_classes lists that are evaluated as logical AND. The affected classes (PluginSettingList as a ListAPI, PluginAllSettingList as an APIView, PluginSettingDetail as a RetrieveUpdateAPI, plus PluginDetail) relied solely on the project's GlobalSettingsPermissions class, which returns True for safe HTTP methods such as GET, HEAD and OPTIONS, combined with the AllowAnyOrReadScope helper. Because AuthRequiredMiddleware explicitly exempts /api/ paths from its authentication gate, no other layer enforced authentication on these endpoints, so anonymous clients could read plugin setting metadata. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), specifically a missing authorization check rather than a memory-safety or injection flaw. The upstream fix in pull request 12168 adds permissions.IsAuthenticated ahead of GlobalSettingsPermissions on PluginDetail, PluginSettingList, PluginAllSettingList, PluginSettingDetail and ObservabilityEnd, bumps INVENTREE_API_VERSION from 505 to 506, and adds regression tests (PluginUnauthenticatedAccessTest) asserting HTTP 401 for anonymous requests. The CPE cpe:2.3:a:inventree:inventree:*:*:*:*:*:*:*:* reflects that the wildcard covers all releases before the fixed version.

Know when Inventree gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI 5.3 MEDIUM

Anonymous network GET reaches the endpoint (AV:N/AC:L/PR:N/UI:N); only non-secret metadata leaks (C:L), with no write or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Sep 21, 2026 - 20:02 EUVD

DescriptionCVE.org

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

Threat Intelligence Overview

EPSS Score

0.4%

Top 70% exploitable

Prevalence

Low

niche open-source inventory management system, limited enterprise footprint

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.4%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +26

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.