CVE-2026-61744

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61744

InvenTree , an open-source inventory management system, is affected by an authorization bypass in its barcode-scan API (POST /api/barcode/) prior to 1.4.0 . The endpoint requires only authentication or a general read scope via IsAuthenticatedOrReadScope, and the built-in barcode plugin resolves o...

CVE-2026-61744: Authorization Bypass Through User-Controlled Key

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

PT-2026-96214

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description An issue exists where the POST /api/barcode/ endpoint accepts synthesized internal JSON barcodes containing a lowercase model label and an integer primary key. Because the BarcodeView only requires...