CVE-2026-61748

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting object...

CVE-2026-61748

InvenTree is an open-source inventory management system. Prior to version 1.4.0 , the ReportPrint and LabelPrint endpoints (POST /api/report/print/ and POST /api/report/label/print/) require authentication but fail to invoke the caller's per-model permission check before selecting objects by prim...