CVE-2026-61746

InvenTree , an open-source inventory management system, is vulnerable prior to 1.4.0 . The PluginSettingList , PluginAllSettingList , and PluginSettingDetail classes use GlobalSettingsPermissions without requiring IsAuthenticated, and since AuthRequiredMiddleware exempts /api/ paths, unauthentica...