EUVD-2026-84057

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

PT-2026-96215

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description An issue exists where PluginSettingList, PluginAllSettingList, and PluginSettingDetail use GlobalSettingsPermissions without the IsAuthenticated permission. Because GlobalSettingsPermissions allows...