Vulnerability details
CVE-2026-35476
inventree InvenTree
InvenTree Affected by Privilege Escalation via API
CVSS 3.1
7.2High
Official description
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.2High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| inventree | InvenTree | < 1.2.7 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2 x_refsource_CONFIRM
- https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust x_refsource_MISC
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-04-08
- Last updated
- 2026-04-08
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.14%
Probability of exploitation in 30 days
3.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-285Improper Authorization