EUVD-2026-84057

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints...

CVE-2026-61746

InvenTree , an open-source inventory management system, is vulnerable prior to 1.4.0 . The PluginSettingList , PluginAllSettingList , and PluginSettingDetail classes use GlobalSettingsPermissions without requiring IsAuthenticated, and since AuthRequiredMiddleware exempts /api/ paths, unauthentica...