CVE-2026-61745

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/pk/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lack...

CVE-2026-61745

InvenTree , an open-source inventory management system, contains a missing authorization flaw in the POST /api/machine/{pk}/restart/ endpoint (src/backend/InvenTree/machine/api.py). The endpoint uses IsAuthenticatedOrReadScope without requiring the ADMIN role that other machine management operati...