CVE-2026-35476

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust	Product
https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-08 20:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35476

Mitre link : CVE-2026-35476

CVE.ORG link : CVE-2026-35476

JSON object : View

Products Affected

inventree_project

inventree

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-35476", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35476", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-08T19:53:23.187630Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "inventree", "product": "InvenTree", "versions": [{"status": "affected", "version": "< 1.2.7"}]}]}], "published": "2026-04-08T20:16:24.323", "references": [{"url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0."}, {"lang": "es", "value": "InvenTree es un Sistema de Gesti\u00f3n de Inventario de C\u00f3digo Abierto. Antes de las versiones 1.2.7 y 1.3.0, un usuario autenticado no-staff pod\u00eda elevar su cuenta a un nivel de personal a trav\u00e9s de una solicitud POST contra el endpoint de su cuenta de usuario. Los permisos de escritura en el endpoint de la API est\u00e1n configurados incorrectamente, permitiendo a cualquier usuario cambiar su estado de personal. Esta vulnerabilidad est\u00e1 corregida en las versiones 1.2.7 y 1.3.0."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E37FC80D-0C3A-425E-A35A-A8EA3B0B4F15", "versionEndIncluding": "1.2.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}