InvenTree EUVD-2026-84058

Requires an authenticated InvenTree account (any role, including a role-less or unrelated-role user) on a version prior to 1.4.0; no admin or elevated privilege is needed. Exploitation targets the report/label print endpoints POST /api/report/print/ and POST /api/report/label/print/ and depends on default report/label templates existing for the target business models (InvenTree ships these for major models by default) and on the DataOutput mechanism storing the rendered artifact for the requesting user. The attacker must enumerate valid object primary keys for the target model. Limiting factors: valid credentials are mandatory (PR:L), impact is confidentiality-only (no data modification or DoS), and disclosure is bounded to fields rendered by the available templates.

This is a genuine but modest-severity broken-access-control issue (CWE-639). The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) is internally consistent with the description and I concur: network-reachable API, low complexity, but requires an authenticated account (PR:L) and yields only confidentiality impact (C:L, no integrity/availability). No EPSS score, no CISA KEV listing, and no public exploit code were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no SSVC framework data in the input. The realistic exploitability is meaningful because the source-code diff (PR #12142) confirms the root cause precisely - the print endpoints omitted users.permissions.check_user_permission before selecting objects and rendering - and default templates exist for major business models, so a low-privilege account can extract data the detail APIs would deny. However, the confidentiality scope is bounded to whatever data the default report/label templates expose, and an authenticated foothold is required, which keeps real-world risk moderate rather than critical. No signals conflict; this is a correctly-scored medium-low issue, not an inflated high-CVSS finding.

An attacker who holds any low-privilege or role-less InvenTree account (e.g., a limited warehouse or read-only user) sends POST requests to /api/report/print/ or /api/report/label/print/, referencing a default template plus a range of enumerated primary keys for models they are not authorized to view. Because DataOutput stores the rendered artifact for the requesting user, they then download reports containing purchase, sales, pricing, BOM, stock, supplier, and customer data. No public exploit code is identified, but the fixing PR diff publicly documents the exact vulnerable code path, lowering the bar to reproduce.