CVE-2026-61745: Missing Authorization

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

PT-2026-96200

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description The POST '/api/machine/pk/restart/' endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role. This allows any authenticated user, such as...