CVE-2026-61747
Received Received - Intake

InvenTree Unauthorized Data Access via Import Session Exposure

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61747
EUVD
EUVD-2026-84055

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
inventree inventree 1.4.0
inven_tree inven_tree to 1.4.0 (exc)
inven_tree inven_tree 1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in InvenTree's data-import API. The /api/importer/row/ and /api/importer/mapping/ endpoints do not restrict access to data based on the user's ownership of import sessions. Any authenticated user can access another user's imported rows and column mappings by manipulating session IDs, exposing staged import data across users.

Detection Guidance

To detect this vulnerability, check if your InvenTree instance is running a version prior to 1.4.0. Use commands like 'pip show InvenTree' or check the version via the web interface. Verify if the endpoints /api/importer/row/ and /api/importer/mapping/ are accessible and if they return data for sessions not owned by the requesting user.

Impact Analysis

An attacker with authenticated access could retrieve sensitive data staged for import by other users, including row data and column mappings. This could expose confidential information such as inventory details, product data, or other sensitive content that other users intended to import into the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Exposure of such data may result in compliance breaches, legal penalties, and reputational damage due to unauthorized disclosure of confidential information.

Mitigation Strategies

Upgrade InvenTree to version 1.4.0 or later immediately. Ensure no unauthorized access has occurred by reviewing import session logs and data. Restrict user permissions if necessary and monitor for unusual activity in data import sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart