Data Exposure in InvenTree Open Source Inventory Management System
CVE-2026-61747

4.3MEDIUM

Key Information:

Vendor

Inventree

Status
Inventree
Vendor
CVE Published:
21 September 2026

What is CVE-2026-61747?

InvenTree, an Open Source Inventory Management System, prior to version 1.4.0, has a significant vulnerability where the /api/importer/row/ and /api/importer/mapping/ endpoints fail to properly scope DataImportRow and DataImportColumnMap querysets. This oversight allows any authenticated user, including those without specific role assignments, to access another user's import session data by supplying the session identifier. As a result, they can retrieve sensitive information regarding row data and column mappings, effectively exposing data intended only for specific users. Although InvenTree's architecture considers authenticated users as trusted, this vulnerability raises serious security concerns regarding data confidentiality. The issue has been addressed in version 1.4.0.

Affected Version(s)

InvenTree < 1.4.0

References

https://github.com/inventree/InvenTree/security/advisorie...
x_refsource_CONFIRM
https://github.com/inventree/InvenTree/pull/12169
x_refsource_MISC
https://github.com/inventree/InvenTree/commit/3c17367e3c2...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.