InvenTree Inventory Management System Vulnerability Exposes Machine Restart Functionality

CVE-2026-61745

What is CVE-2026-61745?

The InvenTree Inventory Management System is susceptible to an authorization bypass vulnerability in its POST /api/machine/{pk}/restart/ endpoint. Prior to version 1.4.0, the endpoint allowed any authenticated user, regardless of their assigned roles, to restart machines. This results in potential disruption of active operations, such as printing and scanning, by enabling users without the necessary ADMIN permissions to invoke critical machine functions. The vulnerability has been addressed in version 1.4.0, which implements appropriate role checks to mitigate this risk and enhance overall system security.

References