CVE-2026-33530

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

• CWE-202

• https://github.com/inventree/InvenTree/pull/11581Issue Tracking, Patch
• https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qgVendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33525Authelia is an open-source authentication and authorization …6.1
• CVE-2026-33526Squid is a caching proxy for the Web. Prior to version 7.5, …7.5
• CVE-2026-33527Parse Server is an open source backend that can be deployed …4.3
• CVE-2026-33528GoDoxy is a reverse proxy and container orchestrator for sel…6.5
• CVE-2026-33529Zoraxy is a general purpose HTTP reverse proxy and forwardin…8.8
• CVE-2026-3353The Comment SPAM Wiper plugin for WordPress is vulnerable to…4.4
• CVE-2026-33531InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-33532`yaml` is a YAML parser and serialiser for JavaScript. Parsi…4.3
• CVE-2026-33533Glances is an open-source system cross-platform monitoring t…6.5
• CVE-2026-33534EspoCRM is an open source customer relationship management a…4.3
• CVE-2026-33535ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-33536ImageMagick is free and open-source software used for editin…4.7