CVE-2026-61744

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61744
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61744.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61744
Aliases
  • GHSA-6pm3-m334-mr4j
Published
2026-09-21T18:45:38Z
Modified
2026-09-22T03:41:07Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
InvenTree: Barcode-scan API (`POST /api/barcode/`) returns full serialized object data without enforcing the model's view role
Details

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and requires only authentication or a general read scope. The built-in barcode plugin selects the object with model.objects.get(pk=...), and InvenTreeBarcodeMixin.format_matched_response() returns the complete model serializer output as instance without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive inventory, pricing, supplier, customer, and order data. This issue is fixed in version 1.4.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-639",
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61744.json"
}
References

Affected packages

Git / github.com/inventree/inventree

Affected ranges

Type
GIT
Repo
https://github.com/inventree/inventree
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0a9a8b1c54d0811ede0a61ffe3b0427f82ee28e5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.4.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.0.10
0.0.11
0.0.12
0.0.3
0.0.6
0.0.8
0.0.9
0.1.0
0.1.1
0.1.2
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.10.0
0.11.0
0.12.0
0.13.0
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.4.0
0.8.0
0.9.0
v0.*
v0.0.11
v0.0.5
v0.0.7
v0.1.3
v0.7.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61744.json"