CVE-2026-35478: InvenTree has Arbitrary API Token Creation
InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvenTreeto a version that resolves this vulnerability.Fixed in 1.2.7 - Upgrade
Upgrade
InvenTreeto a version that resolves this vulnerability.Fixed in 1.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35478?
CVE-2026-35478 is classified as a high severity vulnerability due to the potential for unauthorized API token creation.
How do I fix CVE-2026-35478?
To fix CVE-2026-35478, upgrade InvenTree to version 1.2.7 or later, where the vulnerability is addressed.
Who is affected by CVE-2026-35478?
Any user of InvenTree versions from 0.16.0 to before 1.2.7 is affected by CVE-2026-35478, enabling the creation of API tokens for other users.
What types of users can be affected by CVE-2026-35478?
CVE-2026-35478 affects all authenticated users, including administrators and superusers within the InvenTree system.
Can CVE-2026-35478 allow for privilege escalation?
Yes, CVE-2026-35478 allows authenticated users to create API tokens for any other user, potentially leading to privilege escalation.