CVE-2026-35476

Published: Apr 8, 2026Modified: Jul 24, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

Affected (1)

Products: Inventree Project: Inventree

Inventree Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Inventree Project Inventree	Up to 1.2.6

Related CWEs

Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References (2)

https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust

Source: security-advisories@github.com

Product

https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2

Source: security-advisories@github.com

Third Party Advisory

Timeline

No history available yet.