CVE-2026-35478
Last modified
CVE-2026-35478 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Inventree Project | Inventree | >= 0.16.0, <= 1.2.6 |
References
- https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rgThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-35478?
How severe is CVE-2026-35478?
How do I fix CVE-2026-35478?
Are you affected by CVE-2026-35478?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST