InvenTree-Path-Traversal-CVE-2026-33531

CVE-2026-33531 — InvenTree 报告模板中的路径遍历漏洞 公告： GHSA-rhc5-7c3r-c769 CVE： CVE-2026-33531 严重性： 中危 发布时间： 2026-03-20 致谢： @alonaki 描述 报告模板引擎中存在一个路径遍历漏洞，允许具有员工（staff）权限的用户通过精心构造的模板标签读取服务器文件系统上的任意文件。 受影响的函数 位于 src/backend/InvenTree/report/templatetags/report.py： encodesvgimage asset uploadedimage...

CVE-2026-61746

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61748

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61744

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61747

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no...

CVE-2026-61749

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-61748

InvenTree is an open-source inventory management system. Prior to version 1.4.0 , the ReportPrint and LabelPrint endpoints (POST /api/report/print/ and POST /api/report/label/print/) require authentication but fail to invoke the caller's per-model permission check before selecting objects by prim...

CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

EUVD-2026-84058

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61748 InvenTree: Report/Label print endpoints ignore per-model permissions

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61746

InvenTree , an open-source inventory management system, is vulnerable prior to 1.4.0 . The PluginSettingList , PluginAllSettingList , and PluginSettingDetail classes use GlobalSettingsPermissions without requiring IsAuthenticated, and since AuthRequiredMiddleware exempts /api/ paths, unauthentica...

CVE-2026-61746 InvenTree: Plugin-settings GET endpoints are readable without authentication

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

EUVD-2026-84057

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

CVE-2026-61744

InvenTree , an open-source inventory management system, is affected by an authorization bypass in its barcode-scan API (POST /api/barcode/) prior to 1.4.0 . The endpoint requires only authentication or a general read scope via IsAuthenticatedOrReadScope, and the built-in barcode plugin resolves o...

CVE-2026-61744 InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...

EUVD-2026-84056

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a...