Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-35479

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentiall
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:0cee9cafc0c5ca27f7021bb152b3b30be728c37f3db025db86ac23f49e141bd2
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0

Affected products and versions

1 source assertion
{"product":"InvenTree","vendor":"inventree","versions":[{"status":"affected","version":"< 1.2.7"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:9febeb90b918794e40ca3ebf3483d9b26ba085560e8f8710785ddaa36cc10534 · sha256:885dbd75bd5fed29… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:9febeb90b918794e40ca3ebf3483d9b26ba085560e8f8710785ddaa36cc10534 · sha256:885dbd75bd5fed29… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

1 source assertion
{"cweId":"CWE-285","description":"CWE-285: Improper Authorization","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:9febeb90b918794e40ca3ebf3483d9b26ba085560e8f8710785ddaa36cc10534 · sha256:885dbd75bd5fed29… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust","tags":["x_refsource_MISC"],"url":"https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9febeb90b918794e40ca3ebf3483d9b26ba085560e8f8710785ddaa36cc10534 · sha256:885dbd75bd5fed29… · /containers/cna/references/1
{"name":"https://docs.inventree.org/en/stable/start/config/#plugin-options","tags":["x_refsource_MISC"],"url":"https://docs.inventree.org/en/stable/start/config/#plugin-options"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9febeb90b918794e40ca3ebf3483d9b26ba085560e8f8710785ddaa36cc10534 · sha256:885dbd75bd5fed29… · /containers/cna/references/2
{"name":"https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7","tags":["x_refsource_CONFIRM"],"url":"https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:9febeb90b918794e40ca3ebf3483d9b26ba085560e8f8710785ddaa36cc10534 · sha256:885dbd75bd5fed29… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer