CVE-2026-61748: InvenTree: Report/Label print endpoints ignore per-model permissions
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.checkuserpermission for the caller's per-model view role before selecting objects by primary key and rendering them with a chosen template. Because default templates exist for major business models and DataOutput stores the generated artifact for the requesting user, a role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InvenTreeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated InvenTree account, including a role-less account or one lacking the relevant per-model view role, can exploit it. The attacker needs to submit POST requests to the report or label print endpoints and provide object identifiers.
Are default deployments affected?
Deployments using versions before 1.4.0 are affected because default templates exist for major business models. Authentication is required, but the affected endpoints do not enforce the caller's per-model view permission before rendering selected objects.
What information could be exposed?
Generated reports or labels can expose data associated with purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory objects. The generated artifact is stored in DataOutput for the requesting user to download.
What should be done if patching cannot happen immediately?
The provided data identifies version 1.4.0 as the fix. Until it is deployed, treat any authenticated account as potentially able to retrieve reports for objects it cannot view through the corresponding detail APIs.