CVE-2026-35478

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35478

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35478.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35478

Aliases

GHSA-qh5j-c28q-c4rg

Published

2026-04-08T19:24:05.044Z

Modified

2026-07-27T03:56:37.907416463Z

Severity

8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator

Summary

InvenTree has Arbitrary API Token Creation

Details

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35478.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-639"
    ]
}

References

Affected packages

Git / github.com/inventree/inventree

Affected ranges

Type

GIT

Repo

https://github.com/inventree/inventree

Events

Introduced

3f2ac5ae53c5894d43826edce86d0c8290463c2f

Fixed

01bf60000462fd19d8f939a0561e55e08f38a260

Database specific

{
    "extracted_events": [
        {
            "introduced": "0.16.0"
        },
        {
            "fixed": "1.2.7"
        },
        {
            "last_affected": "1.2.6"
        }
    ],
    "cpe": "cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35478.json"