Advisories · Technology
InvenTree.
Every CVE that names InvenTree among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.3 Medium
InvenTree: Report/Label print endpoints ignore per-model permissions
- InvenTree
- Broken access control
- CVSS 5.3 Medium
InvenTree: Plugin-settings GET endpoints are readable without authentication
- InvenTree
- Information disclosure
- Broken access control
- CVSS 6.5 Medium
InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role
- InvenTree
- Broken access control
- CVSS 4.3 Medium
InvenTree: Authenticated IDOR in the data-import API exposes other users' imported rows (`row_data`/`data`) and column mappings
- InvenTree
- Broken access control
- CVSS 6.5 Medium
InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure
- InvenTree
- Information disclosure
- Server-side request forgery (SSRF)
- CVSS 4.3 Medium
InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment
- InvenTree
- Broken access control
- CVSS 5.3 Medium
InvenTree has SSRF via Remote Image Download — No IP/Hostname Validation on remote_image URLs
- InvenTree
- Server-side request forgery (SSRF)
- CVSS 6.6 Medium
InvenTree Plugin Installation - Insufficient Permissions
- InvenTree
- Broken access control
- CVSS 7.2 High
InvenTree Affected by Privilege Escalation via API
- InvenTree
- Broken access control
- CVSS 8.3 High
InvenTree has Arbitrary API Token Creation
- InvenTree
- Broken access control
- CVSS 5.5 Medium
InvenTree has SSTI in PART_NAME_FORMAT bypasses CVE-2026-27629 fix via {% if part.pk %} sandbox escape
- InvenTree
- Code injection
- CVSS 4.9 Medium
InvenTree has Path Traversal In Report Templates
- InvenTree
- SQL injection
- CVSS 7.7 High
InvenTree Vulnerable to ORM Filter Injection
- InvenTree
- CWE-202
- CVSS 5.9 Medium
InvenTree Vulnerable to Server Side Template Injection (SSTI)
- InvenTree
- Code injection
- CVSS 3.5 Low
InvenTree has uncontrolled memory allocation via built-in label-sheet plugin
- InvenTree
- Denial of service
- CVSS 7.3 High
Stored Cross-site Scripting Vulnerability in Markdown Editor
- InvenTree
- Cross-site scripting (XSS)