CVE-2026-35476CWE-285

CVE-2026-35476

High · published April 9, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00240 · 14.3th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-04-09T00:16Z
Affected products (1)
ProductVersionsFixed in
inventree_project/inventree≤ 1.2.6—
References (2)
https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust · [email protected]https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2 · [email protected]
EPSS history
Timeline
  • 08 APR 19:26Z
    InvenTree Affected by Privilege Escalation via API
    cvelistv5