CVE-2026-61744

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.

• CWE-639
• CWE-863

• https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984
• https://github.com/inventree/InvenTree/pull/12233
• https://github.com/inventree/InvenTree/releases/tag/1.4.0
• https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j

Published

Sep 21, 2026

Last Modified

Sep 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61736LightRAG provides simple and fast retrieval-augmented genera…9.3
• CVE-2026-6174The CC Child Pages plugin for WordPress is vulnerable to Sto…6.4
• CVE-2026-61740LightRAG provides simple and fast retrieval-augmented genera…9.3
• CVE-2026-61741http4s-scala-xml provides `EntityDecoder[F, scala.xml.Elem]`…9.3
• CVE-2026-61742DBHub is a database MCP server for Postgres, MySQL, SQL Serv…9.3
• CVE-2026-61743Chartbrew is an open-source web application that can connect…6.3
• CVE-2026-61745InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-61746InvenTree is an Open Source Inventory Management System. Pri…5.3
• CVE-2026-61747InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-61748InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-61749InvenTree is an Open Source Inventory Management System. Pri…6.5
• CVE-2026-6175Rejected reason: This CVE ID has been rejected or withdrawn …