inventree InvenTree vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 202614

Newest CVEs

• CVE-2026-61748

  InvenTree: Report/Label print endpoints ignore per-model permissions

  inventree · InvenTree

  Medium4.3
• CVE-2026-61746

  InvenTree: Plugin-settings GET endpoints are readable without authentication

  inventree · InvenTree

  Medium5.3
• CVE-2026-61744

  InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

  inventree · InvenTree

  Medium6.5
• CVE-2026-61747

  InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings

  inventree · InvenTree

  Medium4.3
• CVE-2026-61749

  InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure

  inventree · InvenTree

  Medium6.5
• CVE-2026-61745

  InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

  inventree · InvenTree

  Medium4.3
• CVE-2026-39362

  InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs

  inventree · InvenTree

  Medium5.3
• CVE-2026-35479

  InvenTree Plugin Installation - Insufficient Permissions

  inventree · InvenTree

  Medium6.6
• CVE-2026-35476

  InvenTree Affected by Privilege Escalation via API

  inventree · InvenTree

  High7.2
• CVE-2026-35478

  InvenTree has Arbitrary API Token Creation

  inventree · InvenTree

  High8.3