Data Exfiltration Vulnerability in InvenTree Inventory Management System
CVE-2026-33530

7.7HIGH

Key Information:

Vendor

Inventree

Status
Inventree
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33530?

InvenTree, an Open Source Inventory Management System, has a vulnerability that allows authenticated users to exfiltrate sensitive data via certain API endpoints before version 1.2.6. The bulk operation API endpoints, including /api/part/, /api/stock/, and /api/order/so/allocation/, do not validate filters passed to Django's ORM. This lack of field allowlisting enables attackers to traverse model relationships and perform unauthorized data extraction. It is crucial for users to upgrade to version 1.2.6 or higher to mitigate this risk, as no workarounds exist.

Affected Version(s)

InvenTree < 1.2.6

References

https://github.com/inventree/InvenTree/security/advisorie...
x_refsource_CONFIRM
https://github.com/inventree/InvenTree/pull/11581
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.