{"schema_version":"1","data":[{"id":3498,"advisory_id":"5e00968b-15ad-4933-870e-e8f790727713","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61744","source_published_at":"2026-09-21T18:45:38.373+00:00","published_at":"2026-10-24T21:36:11.449039+00:00","extraction_method":"structured","technologies":["core-cve","inventree"],"cve_ids":["CVE-2026-61744"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role","summary":"InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.","evidence":"cve:CVE-2026-61744","products":[{"name":{"value":"InvenTree","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-61744","aliases":["CVE-2026-61744"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"inventree","product":"InvenTree","versions":[{"status":"affected","version":"< 1.4.0"}]}],"modified":"2026-09-29T15:07:12.160Z","provider":"cve","references":["https://github.com/inventree/InvenTree/security/advisories/GHSA-6pm3-m334-mr4j","https://github.com/inventree/InvenTree/pull/12233","https://github.com/inventree/InvenTree/commit/f21bc2d06f906838e760d2face15cc50cc9df984","https://github.com/inventree/InvenTree/releases/tag/1.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61744","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-29T15:07:03.974809Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-29T15:07:12.160Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T18:45:38.373Z"}}},"related_cves":[{"value":"CVE-2026-61744","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":1951,"advisory_id":"fdab2a45-afe6-4a05-a99e-8e63311df3a3","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61749","source_published_at":"2026-09-21T18:31:54.532+00:00","published_at":"2026-10-24T21:10:44.428892+00:00","extraction_method":"structured","technologies":["core-cve","inventree"],"cve_ids":["CVE-2026-61749"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure","summary":"InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The HTML(string=html).write_pdf() path does not provide a restricted url_fetcher, and attach_to_model=True stores the original generated PDF before later processing, allowing fetched local files or internal HTTP response bodies to be recovered from embedded attachments. This enables full-read server-side request forgery, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.","evidence":"cve:CVE-2026-61749","products":[{"name":{"value":"InvenTree","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-61749","aliases":["CVE-2026-61749"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"HIGH","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"inventree","product":"InvenTree","versions":[{"status":"affected","version":"< 1.4.0"}]}],"modified":"2026-09-24T22:29:20.432Z","provider":"cve","references":["https://github.com/inventree/InvenTree/security/advisories/GHSA-568x-qh23-wh8g","https://github.com/inventree/InvenTree/pull/12160","https://github.com/inventree/InvenTree/commit/2b4f3037703bd499e420b6904153f2b66878d61b","https://github.com/inventree/InvenTree/releases/tag/1.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61749","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-09-24T22:29:08.431867Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:29:20.432Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T18:31:54.532Z"}}},"related_cves":[{"value":"CVE-2026-61749","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false},{"id":1950,"advisory_id":"a998eee0-1478-4759-8738-f22751c91d61","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-61748","source_published_at":"2026-09-21T18:47:14.044+00:00","published_at":"2026-10-24T21:10:43.853436+00:00","extraction_method":"structured","technologies":["core-cve","inventree"],"cve_ids":["CVE-2026-61748"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"InvenTree: Report/Label print endpoints ignore per-model permissions","summary":"InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.","evidence":"cve:CVE-2026-61748","products":[{"name":{"value":"InvenTree","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-61748","aliases":["CVE-2026-61748"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"inventree","product":"InvenTree","versions":[{"status":"affected","version":"< 1.4.0"}]}],"modified":"2026-09-24T22:30:22.380Z","provider":"cve","references":["https://github.com/inventree/InvenTree/security/advisories/GHSA-7w96-99fj-8g7x","https://github.com/inventree/InvenTree/pull/12142","https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175","https://github.com/inventree/InvenTree/releases/tag/1.4.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-61748","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-24T22:30:13.197826Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-24T22:30:22.380Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-21T18:47:14.044Z"}}},"related_cves":[{"value":"CVE-2026-61748","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"context_update":false}],"next_after":3498,"next_before":1950}