Open Source Inventory Management System Vulnerability in InvenTree by InvenTree

CVE-2026-61744

What is CVE-2026-61744?

InvenTree, an Open Source Inventory Management System, prior to version 1.4.0, is susceptible to an improper access control issue. The system's API endpoint allows a low-privileged user to craft internal JSON barcodes, obtaining sensitive information from the database. By exploiting this vulnerability, attackers can enumerate primary keys related to parts, stock, locations, and orders, which may lead to unauthorized disclosure of commercially sensitive data, including pricing, supplier, and customer information. This exposure poses significant risks to businesses relying on InvenTree for inventory management. A fix was implemented in version 1.4.0 to address this critical flaw.

References