CVE-2026-61745
Received Received - Intake

Privilege Escalation in InvenTree via Machine Restart

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61745
EUVD
EUVD-2026-84039

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
inventree inventree 1.4.0
inventree inventree to 1.3.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-61745 is a security vulnerability in InvenTree, an open-source inventory management system. The issue involves a missing authorization check on the machine restart endpoint, allowing any authenticated user—regardless of their role—to restart production equipment such as label printers or scanners. This can disrupt ongoing operations, including active print jobs, leading to potential denial-of-service conditions in production environments.

Detection Guidance

To detect this vulnerability, check if your InvenTree instance is running a version prior to 1.4.0. Use the API endpoint /api/machine/{pk}/restart/ to test if non-admin users can trigger machine restarts. Verify user roles and permissions in the system settings.

Impact Analysis

This vulnerability allows any authenticated user, even with limited roles like STOCK, to restart machines. This can interrupt critical operations such as printing, scanning, or other machine activities, causing disruptions in production workflows and potential data loss or delays in order fulfillment.

Compliance Impact

This vulnerability could potentially impact compliance with standards requiring strict access controls for sensitive operations. The lack of proper authorization checks allows unauthorized users to restart production equipment, which may disrupt critical operations like label printing. This could lead to violations of data integrity or availability requirements in regulations such as GDPR or HIPAA, depending on the context of use.

Mitigation Strategies

Upgrade InvenTree to version 1.4.0 or later immediately. Ensure only staff users have permission to restart machines. Review and restrict API access for non-admin roles. Monitor machine restart logs for unauthorized activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61745. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart