Vulnerability · Published Sep 21, 2026 · Assigned by GitHub_M

CVE-2026-61746InvenTree: Plugin-settings GET endpoints are readable without authentication

Medium 5.3

In plain English

A medium-severity information exposure in InvenTree from inventree. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 65.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
inventree	InvenTree	< 1.4.0

Weakness: CWE-200, CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7 x_refsource_CONFIRM
https://github.com/inventree/InvenTree/pull/12168 x_refsource_MISC
https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0 x_refsource_MISC
https://github.com/inventree/InvenTree/releases/tag/1.4.0 x_refsource_MISC