CVE-2026-61745: InvenTree: Missing authorization on machine restart endpoint allows any authenticated user to interrupt production equipment
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restartmachine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.4.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated InvenTree user who does not have the ADMIN role can exploit it, including a warehouse user assigned only the STOCK role. The user can restart any registered machine.
Are default deployments affected?
The affected restart endpoint requires authentication, but it does not require the ADMIN role. Deployments running a version prior to 1.4.0 are affected where non-admin authenticated users can access the API.
What is the operational impact of exploitation?
A successful request resets the targeted machine's status and can interrupt active printing, scanning, or other machine operations. The issue affects availability rather than confidentiality or data integrity.
What should be done if upgrading is not immediately possible?
Restrict access to the machine restart API endpoint so that only administrators can invoke it, and limit or remove nonessential authenticated accounts and roles that could reach the endpoint. Upgrade to InvenTree 1.4.0 when possible.