inventree InvenTree

• CVE-2026-61748 Medium 4.3 InvenTree: Report/Label print endpoints ignore per-model permissions 0.4%
• CVE-2026-61746 Medium 5.3 InvenTree: Plugin-settings GET endpoints are readable without authentication 0.4%
• CVE-2026-61744 Medium 6.5 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role 0.5%
• CVE-2026-61747 Medium 4.3 InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings 0.3%
• CVE-2026-61749 Medium 6.5 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure 0.5%
• CVE-2026-61745 Medium 4.3 InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment 0.4%
• CVE-2026-39362 Medium 5.3 InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs 0.2%
• CVE-2026-35479 Medium 6.6 InvenTree Plugin Installation - Insufficient Permissions 0.2%
• CVE-2026-35476 High 7.2 InvenTree Affected by Privilege Escalation via API 0.1%
• CVE-2026-35478 High 8.3 InvenTree has Arbitrary API Token Creation 0.3%
• CVE-2026-35477 Medium 5.5 InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape 0.3%
• CVE-2026-33531 Medium 4.9 InvenTree has Path Traversal In Report Templates 0.3%
• CVE-2026-33530 High 7.7 InvenTree Vulnerable to ORM Filter Injection 0.2%
• CVE-2026-27629 Medium 5.9 InvenTree Vulnerable to Server Side Template Injection (SSTI) 0.3%
• CVE-2025-49000 Low 3.5 InvenTree has uncontrolled memory allocation via built-in label-sheet plugin 0.4%
• CVE-2024-47610 High 7.3 Stored Cross-site Scripting Vulnerability in Markdown Editor 0.3%