CVE-2026-61744
Received Received - Intake

Information Disclosure in InvenTree via Barcode API

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61744
EUVD
EUVD-2026-84056

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
inventree inventree 1.4.0
inventree inventree to 1.4.0 (exc)
inventree inventree to 1.3.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61744 is a vulnerability in InvenTree, an open-source inventory management system. It allows low-privilege authenticated users to bypass role-based access control and read sensitive data through the barcode scanning API endpoint (POST /api/barcode/). The issue occurs because the endpoint only checks for basic authentication or a read scope, without enforcing model-specific view roles. Attackers can send crafted barcode requests with a model label and integer primary key to enumerate through IDs and retrieve full serialized object data for parts, stock, locations, orders, and other sensitive records.

Detection Guidance

Check InvenTree versions prior to 1.4.0 for the vulnerable barcode API endpoint. Monitor logs for unauthorized barcode scan requests or unusual enumeration attempts targeting primary keys. Review API access logs for POST requests to /api/barcode/ with model labels like stockitem, part, or order.

Impact Analysis

This vulnerability allows unauthorized users to access commercially sensitive data such as inventory details, pricing, supplier information, customer data, and order specifics. Attackers can enumerate primary keys to disclose confidential business information, potentially leading to data breaches, competitive disadvantages, or compliance violations. The impact is high on confidentiality as sensitive fields like supplier SKUs, quantities, and order details can be exposed.

Compliance Impact

This vulnerability could lead to non-compliance with regulations like GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access to inventory, supplier, or customer data may result in legal penalties, fines, or reputational damage for organizations handling regulated information.

Mitigation Strategies

Upgrade InvenTree to version 1.4.0 or later to apply the fix. Ensure all users have appropriate view permissions for models accessed via barcode scanning. Review and restrict API access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61744. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart