Vulnerability · Published Apr 8, 2026 · Assigned by GitHub_M

CVE-2026-35479InvenTree Plugin Installation - Insufficient Permissions

Medium 6.6

In plain English

A medium-severity security flaw in InvenTree from inventree. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.2%top 87.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.

Affected products (as reported)

Vendor	Product	Versions
inventree	InvenTree	< 1.2.7

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

References

https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7 x_refsource_CONFIRM
https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust x_refsource_MISC
https://docs.inventree.org/en/stable/start/config/#plugin-options x_refsource_MISC