CVE-2026-35476

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust	Product
https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*

History

21 Apr 2026, 13:34

Type	Values Removed	Values Added
First Time		Inventree Project Inventree Project inventree
CPE		cpe:2.3:a:inventree_project:inventree::::::::
References	~~() https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust -~~	() https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust - Product
References	~~() https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2 -~~	() https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2 - Third Party Advisory

08 Apr 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-08 20:16

Updated : 2026-04-21 13:34

NVD link : CVE-2026-35476

Mitre link : CVE-2026-35476

CVE.ORG link : CVE-2026-35476

JSON object : View

Products Affected

inventree_project

inventree

CWE

CWE-285

Improper Authorization

{"id": "CVE-2026-35476", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-04-08T20:16:24.323", "references": [{"url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust", "tags": ["Product"], "source": "security-advisories@github.com"}, {"url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0."}], "lastModified": "2026-04-21T13:34:40.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E37FC80D-0C3A-425E-A35A-A8EA3B0B4F15", "versionEndIncluding": "1.2.6"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}