Inventree
Monthly
Authentication bypass in InvenTree open source inventory management system allows any authenticated user to generate API tokens for arbitrary users, including administrators, enabling complete account takeover. Affected versions 0.16.0 through 1.2.6 permit low-privileged users to forge API credentials by manipulating the user field in POST requests to /api/user/tokens/. Resulting tokens provide full API access from any network location without requiring victim interaction. No public exploit identified at time of analysis.
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
InvenTree versions prior to 1.4.0 expose business data through the report and label print endpoints because POST /api/report/print/ and POST /api/report/label/print/ authenticate the caller but never invoke users.permissions.check_user_permission against the target model's view role. Any authenticated account - including one with no roles or only unrelated roles - can enumerate object primary keys and render them through the default templates InvenTree ships for major business models, then retrieve the resulting artifact from DataOutput, obtaining purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would correctly deny. Fixed in 1.4.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and the EPSS-style risk is modest because valid credentials are required and impact is limited to confidentiality (CVSS 4.3, CWE-639).
Unauthenticated information disclosure in InvenTree prior to 1.4.0 lets a remote caller retrieve plugin names, setting keys, descriptions, types, choices and non-secret configuration values through /api/plugin/settings/ and the per-plugin settings endpoints, because PluginSettingList, PluginAllSettingList and PluginSettingDetail registered GlobalSettingsPermissions without the IsAuthenticated permission used by equivalent global-settings endpoints. Exposure is confined to metadata and non-secret configuration: protected secret values remain masked as three asterisks, only safe methods are readable, and at least one plugin must be installed and active for the disclosure to be meaningful, so the practical impact is limited. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), confirming remote unauthenticated exploitation with low confidentiality impact and no integrity or availability effect; no public exploit identified at time of analysis.
Broken object-level authorization in InvenTree prior to 1.4.0 allows any authenticated low-privilege user - or any holder of an API token with only a general read scope - to retrieve the full serializer output for arbitrary records by posting a crafted internal JSON barcode to /api/barcode/. Because the barcode endpoint authenticates the caller but never checks the caller's per-model view role, an attacker can enumerate integer primary keys for parts, stock items, stock locations, supplier and manufacturer parts, purchase/sales orders, and builds, disclosing commercially sensitive inventory, pricing, supplier, customer, and order data. The vendor rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), confirming a network-reachable, read-only confidentiality impact that requires valid low-privilege credentials; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Broken object-level authorization in InvenTree versions prior to 1.4.0 lets any authenticated user, including an account with no assigned roles, read the staged import data and column mappings belonging to another user's DataImportSession by supplying that session's identifier to the /api/importer/row/ or /api/importer/mapping/ endpoints. The impact is confidentiality-only (CVSS 4.4 base, assessed as 4.3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid login plus knowledge or enumeration of a victim's session ID on an instance where another user has an active import in progress; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). The vendor's threat model treats authenticated instance users as trusted, so the realistic exposure is between distrustful co-tenants of the same instance rather than remote outsiders, and version 1.4.0 resolves it.
InvenTree versions prior to 1.4.0 render report and label templates with WeasyPrint's default URL fetcher, so an authenticated staff user who can author templates can make the server fetch attacker-chosen resources over http/https or read local files through the file:// scheme and later recover the fetched bytes from the stored PDF attachment. This yields full-read server-side request forgery, local file disclosure (potentially including application credentials), and in the worst case compromise of a superuser account. The issue is access-gated and not a broad internet-facing threat: it requires staff-level template-authoring privileges (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N, base 6.5) plus the ability to retrieve the generated attachment, and no public exploit has been identified at time of analysis. A vendor-released fix is available in InvenTree 1.4.0.
InvenTree versions prior to 1.4.0 expose the machine restart endpoint POST /api/machine/{pk}/restart/ to any authenticated user, allowing an account holding only low-privilege roles such as STOCK to force registry.restart_machine() against any registered machine. A successful request resets the target machine's status and interrupts active printing, scanning, or other hardware operations, giving an authenticated attacker (PR:L per the assessed vector) a network-reachable denial-of-service against configured machine integrations. Impact is limited to availability (C:N/I:N/A:L, CVSS 4.3); there is no data exposure or modification, and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with no registered machines have no exploitable surface.
Server-side request forgery (SSRF) in InvenTree prior to versions 1.2.7 and 1.3.0 allows authenticated users to request arbitrary internal URLs when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled, bypassing URL validation through HTTP redirect chains. An attacker with valid credentials can probe internal networks, access cloud metadata endpoints, or interact with backend services not exposed to the public internet by supplying crafted remote_image URLs that are fetched server-side without IP-range restrictions.
InvenTree prior to versions 1.2.7 and 1.3.0 allows staff-level users to install arbitrary plugins via the API without requiring superuser privileges, enabling privilege escalation and potential code execution. The vulnerability exists because plugin installation permissions are inconsistently enforced compared to other plugin operations (such as uninstallation) that correctly require superuser access. Staff users, typically considered lower-trust accounts than superusers, can exploit this to deploy malicious plugins with full application context. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in InvenTree inventory management system versions prior to 1.2.7 and 1.3.0 allows remote unauthenticated attackers to elevate any user account to staff level through improperly secured API endpoints. Exploitation requires no special conditions beyond network access and enables unauthorized administrative access to inventory management functions. EPSS score of 0.03% (8th percentile) indicates low observed exploitation likelihood, and SSVC assessment confirms no known exploitation with non-automatable attack requiring user account creation first.
InvenTree versions prior to 1.2.6 contain a path traversal vulnerability in the report template engine that allows authenticated staff users to read arbitrary files from the server filesystem through crafted template tags in the `encode_svg_image()`, `asset()`, and `uploaded_image()` functions. An attacker with staff privileges can exploit this to access sensitive files if the InvenTree installation runs with elevated host system permissions. Vendor-released patches are available in versions 1.2.6 and 1.3.0 or later; no public exploit code or active exploitation has been confirmed at this time.
Authenticated attackers with low-level privileges can exfiltrate sensitive database information from InvenTree open source inventory management systems prior to version 1.2.6 by abusing unvalidated filter parameters in bulk operation API endpoints. The vulnerability enables blind boolean-based data extraction through Django ORM relationship traversal, achieving high confidentiality impact with changed scope per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (score 7.7). No public exploit identified at time of analysis, and vendor-released patches are available in versions 1.2.6 and 1.3.0.
InvenTree prior to version 1.2.3 allows authenticated staff users to inject malicious Jinja2 template code into batch code generation functionality, enabling server-side template injection that can expose sensitive data or execute arbitrary code. Once a staff member modifies the template maliciously, any user triggering batch code generation via the API will execute the injected code within their user context. This vulnerability requires staff-level access to set up but can be exploited by lower-privileged users once the malicious template is in place.
InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
InvenTree is an Open Source Inventory Management System. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authentication bypass in InvenTree open source inventory management system allows any authenticated user to generate API tokens for arbitrary users, including administrators, enabling complete account takeover. Affected versions 0.16.0 through 1.2.6 permit low-privileged users to forge API credentials by manipulating the user field in POST requests to /api/user/tokens/. Resulting tokens provide full API access from any network location without requiring victim interaction. No public exploit identified at time of analysis.
Remote code execution in InvenTree 1.2.3 through 1.2.6 allows staff users with settings access to execute arbitrary code by crafting malicious Jinja2 templates that bypass sandbox validation. The vulnerability exists because the PART_NAME_FORMAT validator uses a sandboxed Jinja2 environment, but the actual rendering engine in part/helpers.py uses an unsandboxed environment, combined with a validation bypass via dummy Part instances with pk=None that behave differently during validation versus production execution. No public exploit code or active exploitation confirmed at time of analysis.
InvenTree versions prior to 1.4.0 expose business data through the report and label print endpoints because POST /api/report/print/ and POST /api/report/label/print/ authenticate the caller but never invoke users.permissions.check_user_permission against the target model's view role. Any authenticated account - including one with no roles or only unrelated roles - can enumerate object primary keys and render them through the default templates InvenTree ships for major business models, then retrieve the resulting artifact from DataOutput, obtaining purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would correctly deny. Fixed in 1.4.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and the EPSS-style risk is modest because valid credentials are required and impact is limited to confidentiality (CVSS 4.3, CWE-639).
Unauthenticated information disclosure in InvenTree prior to 1.4.0 lets a remote caller retrieve plugin names, setting keys, descriptions, types, choices and non-secret configuration values through /api/plugin/settings/ and the per-plugin settings endpoints, because PluginSettingList, PluginAllSettingList and PluginSettingDetail registered GlobalSettingsPermissions without the IsAuthenticated permission used by equivalent global-settings endpoints. Exposure is confined to metadata and non-secret configuration: protected secret values remain masked as three asterisks, only safe methods are readable, and at least one plugin must be installed and active for the disclosure to be meaningful, so the practical impact is limited. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (score 5.3), confirming remote unauthenticated exploitation with low confidentiality impact and no integrity or availability effect; no public exploit identified at time of analysis.
Broken object-level authorization in InvenTree prior to 1.4.0 allows any authenticated low-privilege user - or any holder of an API token with only a general read scope - to retrieve the full serializer output for arbitrary records by posting a crafted internal JSON barcode to /api/barcode/. Because the barcode endpoint authenticates the caller but never checks the caller's per-model view role, an attacker can enumerate integer primary keys for parts, stock items, stock locations, supplier and manufacturer parts, purchase/sales orders, and builds, disclosing commercially sensitive inventory, pricing, supplier, customer, and order data. The vendor rates this CVSS 3.1 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), confirming a network-reachable, read-only confidentiality impact that requires valid low-privilege credentials; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Broken object-level authorization in InvenTree versions prior to 1.4.0 lets any authenticated user, including an account with no assigned roles, read the staged import data and column mappings belonging to another user's DataImportSession by supplying that session's identifier to the /api/importer/row/ or /api/importer/mapping/ endpoints. The impact is confidentiality-only (CVSS 4.4 base, assessed as 4.3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and requires a valid login plus knowledge or enumeration of a victim's session ID on an instance where another user has an active import in progress; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV). The vendor's threat model treats authenticated instance users as trusted, so the realistic exposure is between distrustful co-tenants of the same instance rather than remote outsiders, and version 1.4.0 resolves it.
InvenTree versions prior to 1.4.0 render report and label templates with WeasyPrint's default URL fetcher, so an authenticated staff user who can author templates can make the server fetch attacker-chosen resources over http/https or read local files through the file:// scheme and later recover the fetched bytes from the stored PDF attachment. This yields full-read server-side request forgery, local file disclosure (potentially including application credentials), and in the worst case compromise of a superuser account. The issue is access-gated and not a broad internet-facing threat: it requires staff-level template-authoring privileges (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N, base 6.5) plus the ability to retrieve the generated attachment, and no public exploit has been identified at time of analysis. A vendor-released fix is available in InvenTree 1.4.0.
InvenTree versions prior to 1.4.0 expose the machine restart endpoint POST /api/machine/{pk}/restart/ to any authenticated user, allowing an account holding only low-privilege roles such as STOCK to force registry.restart_machine() against any registered machine. A successful request resets the target machine's status and interrupts active printing, scanning, or other hardware operations, giving an authenticated attacker (PR:L per the assessed vector) a network-reachable denial-of-service against configured machine integrations. Impact is limited to availability (C:N/I:N/A:L, CVSS 4.3); there is no data exposure or modification, and no public exploit code or confirmed active exploitation was identified at time of analysis. Deployments with no registered machines have no exploitable surface.
Server-side request forgery (SSRF) in InvenTree prior to versions 1.2.7 and 1.3.0 allows authenticated users to request arbitrary internal URLs when the INVENTREE_DOWNLOAD_FROM_URL feature is enabled, bypassing URL validation through HTTP redirect chains. An attacker with valid credentials can probe internal networks, access cloud metadata endpoints, or interact with backend services not exposed to the public internet by supplying crafted remote_image URLs that are fetched server-side without IP-range restrictions.
InvenTree prior to versions 1.2.7 and 1.3.0 allows staff-level users to install arbitrary plugins via the API without requiring superuser privileges, enabling privilege escalation and potential code execution. The vulnerability exists because plugin installation permissions are inconsistently enforced compared to other plugin operations (such as uninstallation) that correctly require superuser access. Staff users, typically considered lower-trust accounts than superusers, can exploit this to deploy malicious plugins with full application context. No public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in InvenTree inventory management system versions prior to 1.2.7 and 1.3.0 allows remote unauthenticated attackers to elevate any user account to staff level through improperly secured API endpoints. Exploitation requires no special conditions beyond network access and enables unauthorized administrative access to inventory management functions. EPSS score of 0.03% (8th percentile) indicates low observed exploitation likelihood, and SSVC assessment confirms no known exploitation with non-automatable attack requiring user account creation first.
InvenTree versions prior to 1.2.6 contain a path traversal vulnerability in the report template engine that allows authenticated staff users to read arbitrary files from the server filesystem through crafted template tags in the `encode_svg_image()`, `asset()`, and `uploaded_image()` functions. An attacker with staff privileges can exploit this to access sensitive files if the InvenTree installation runs with elevated host system permissions. Vendor-released patches are available in versions 1.2.6 and 1.3.0 or later; no public exploit code or active exploitation has been confirmed at this time.
Authenticated attackers with low-level privileges can exfiltrate sensitive database information from InvenTree open source inventory management systems prior to version 1.2.6 by abusing unvalidated filter parameters in bulk operation API endpoints. The vulnerability enables blind boolean-based data extraction through Django ORM relationship traversal, achieving high confidentiality impact with changed scope per CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (score 7.7). No public exploit identified at time of analysis, and vendor-released patches are available in versions 1.2.6 and 1.3.0.
InvenTree prior to version 1.2.3 allows authenticated staff users to inject malicious Jinja2 template code into batch code generation functionality, enabling server-side template injection that can expose sensitive data or execute arbitrary code. Once a staff member modifies the template maliciously, any user triggering batch code generation via the API will execute the injected code within their user context. This vulnerability requires staff-level access to set up but can be exploited by lower-privileged users once the malicious template is in place.
InvenTree is an Open Source Inventory Management System. Prior to version 0.17.13, the skip field in the built-in `label-sheet` plugin lacks an upper bound, so a large value forces the server to allocate an enormous Python list. This lets any authenticated label-printing user trigger a denial-of-service via memory exhaustion. the issue is fixed in versions 0.17.13 and higher. No workaround is available aside from upgrading to the patched version.
InvenTree is an Open Source Inventory Management System. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.