Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-61745InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment

Medium 4.3

In plain English

A medium-severity missing authorization in InvenTree from inventree. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 62.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
inventree	InvenTree	< 1.4.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj x_refsource_CONFIRM
https://github.com/inventree/InvenTree/pull/12197 x_refsource_MISC
https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd x_refsource_MISC
https://github.com/inventree/InvenTree/releases/tag/1.4.0 x_refsource_MISC