CVE-2026-61748: Inventree

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.

Affected products

• Inventree Inventree: before 1.4.0 (fixed in 1.4.0)

Published 2026-09-21. Last modified 2026-09-24.