# InvenTree.

Every CVE that names InvenTree among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [InvenTree: Report/Label print endpoints ignore per-model permissions](https://agentprime.io/advisories/CVE-2026-61748.md)
  `CVE-2026-61748` · CVE record: inventree InvenTree · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [InvenTree: Plugin-settings GET endpoints are readable without authentication](https://agentprime.io/advisories/CVE-2026-61746.md)
  `CVE-2026-61746` · CVE record: inventree InvenTree · CVSS 5.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Broken access control
- [InvenTree: Barcode-scan API (\`POST /api/barcode/\`) returns full serialized object data without enforcing the model's view role](https://agentprime.io/advisories/CVE-2026-61744.md)
  `CVE-2026-61744` · CVE record: inventree InvenTree · CVSS 6.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (\`row_data\`/\`data\`) and column mappings](https://agentprime.io/advisories/CVE-2026-61747.md)
  `CVE-2026-61747` · CVE record: inventree InvenTree · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure](https://agentprime.io/advisories/CVE-2026-61749.md)
  `CVE-2026-61749` · CVE record: inventree InvenTree · CVSS 6.5 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Information disclosure, Server-side request forgery (SSRF)
- [InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment](https://agentprime.io/advisories/CVE-2026-61745.md)
  `CVE-2026-61745` · CVE record: inventree InvenTree · CVSS 4.3 Medium · Not analysed yet · Published 21 Sept 2026 · Tags: Broken access control
- [InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs](https://agentprime.io/advisories/CVE-2026-39362.md)
  `CVE-2026-39362` · CVE record: inventree InvenTree · CVSS 5.3 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Server-side request forgery (SSRF)
- [InvenTree Plugin Installation - Insufficient Permissions](https://agentprime.io/advisories/CVE-2026-35479.md)
  `CVE-2026-35479` · CVE record: inventree InvenTree · CVSS 6.6 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [InvenTree Affected by Privilege Escalation via API](https://agentprime.io/advisories/CVE-2026-35476.md)
  `CVE-2026-35476` · CVE record: inventree InvenTree · CVSS 7.2 High · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [InvenTree has Arbitrary API Token Creation](https://agentprime.io/advisories/CVE-2026-35478.md)
  `CVE-2026-35478` · CVE record: inventree InvenTree · CVSS 8.3 High · Not analysed yet · Published 8 Apr 2026 · Tags: Broken access control
- [InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape](https://agentprime.io/advisories/CVE-2026-35477.md)
  `CVE-2026-35477` · CVE record: inventree InvenTree · CVSS 5.5 Medium · Not analysed yet · Published 8 Apr 2026 · Tags: Code injection
- [InvenTree has Path Traversal In Report Templates](https://agentprime.io/advisories/CVE-2026-33531.md)
  `CVE-2026-33531` · CVE record: inventree InvenTree · CVSS 4.9 Medium · Not analysed yet · Published 26 Mar 2026 · Tags: SQL injection
- [InvenTree Vulnerable to ORM Filter Injection](https://agentprime.io/advisories/CVE-2026-33530.md)
  `CVE-2026-33530` · CVE record: inventree InvenTree · CVSS 7.7 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-202
- [InvenTree Vulnerable to Server Side Template Injection (SSTI)](https://agentprime.io/advisories/CVE-2026-27629.md)
  `CVE-2026-27629` · CVE record: inventree InvenTree · CVSS 5.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Code injection
- [InvenTree has uncontrolled memory allocation via built-in label-sheet plugin](https://agentprime.io/advisories/CVE-2025-49000.md)
  `CVE-2025-49000` · CVE record: inventree InvenTree · CVSS 3.5 Low · Not analysed yet · Published 3 Jun 2025 · Tags: Denial of service
- [Stored Cross-site Scripting Vulnerability in Markdown Editor](https://agentprime.io/advisories/CVE-2024-47610.md)
  `CVE-2024-47610` · CVE record: inventree InvenTree · CVSS 7.3 High · Not analysed yet · Published 7 Oct 2024 · Tags: Cross-site scripting (XSS)

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=inventree>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/inventree/>. Everything for agents: <https://agentprime.io/llms.txt>.