CVE-2026-61748
Received Received - Intake

InvenTree Unauthenticated Data Exposure via ReportPrint

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-22
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61748
EUVD
EUVD-2026-84058

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
inventree inventree to 1.4.0 (exc)
inven_tree inven_tree 1.4.0
inven_tree inven_tree to 1.4.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in InvenTree (versions prior to 1.4.0) involves the ReportPrint and LabelPrint API endpoints. These endpoints require authentication but fail to verify if the user has proper view permissions for the requested data model. As a result, any authenticated user, even without specific roles, can access and download sensitive business data like purchase orders, sales orders, inventory details, and customer information by exploiting default report templates.

Detection Guidance

To detect this vulnerability, check if your InvenTree instance is running a version prior to 1.4.0. Use commands like 'pip show InvenTree' or check the version in the web interface. Verify if POST requests to /api/report/print/ or /api/report/label/print/ are accessible without proper role-based permission checks.

Impact Analysis

If you use InvenTree versions before 1.4.0, an attacker with valid credentials but limited permissions could enumerate object IDs and download reports containing confidential data such as pricing, quantities, supplier details, and customer information. This could lead to data breaches, unauthorized access to business-critical information, and potential compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Unauthorized access to customer, supplier, or inventory data may result in non-compliance with these regulations, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Upgrade InvenTree to version 1.4.0 or later to address the improper access controls in report and label printing endpoints. Ensure no unauthorized users have access to these endpoints until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart