CVE-2026-35476: InvenTree Affected by Privilege Escalation via API
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvenTreeto a version that resolves this vulnerability.Fixed in 1.2.7 - Upgrade
Upgrade
InvenTreeto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35476?
CVE-2026-35476 is classified as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2026-35476?
To remediate CVE-2026-35476, upgrade InvenTree to version 1.2.7 or 1.3.0 or later.
Who is affected by CVE-2026-35476?
CVE-2026-35476 affects users of InvenTree versions prior to 1.2.7 and 1.3.0.
What is the impact of CVE-2026-35476?
The impact of CVE-2026-35476 allows non-staff authenticated users to escalate their privileges to staff level.
How does CVE-2026-35476 exploit the system?
CVE-2026-35476 exploits the system via a POST request to the user account endpoint, manipulating API permissions.