PT-2026-28488 · Inventree · Inventree

Schrodingersgat · Publicado 2026-03-26 · Atualizado 2026-03-26 · CVE-2026-33530

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.2.6 InvenTree versions 1.2.6 through 1.3.0

Description InvenTree is an Open Source Inventory Management System. Certain API endpoints associated with bulk data operations can be exploited to exfiltrate sensitive information from the database. The bulk operation API endpoints, including /api/part/, /api/stock/, /api/order/so/allocation/, and others, accept a filters parameter. This parameter is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This allows authenticated users to traverse model relationships using Django's lookup syntax and perform blind boolean-based data extraction. The filters parameter is the key component in this issue.

Recommendations Update InvenTree to version 1.2.6 or later. Update InvenTree to version 1.3.0 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-202

Identificadores relacionados

CVE-2026-33530

GHSA-M8J2-VFMQ-P6QG

Produtos afetados

Inventree

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33530.json · Exploit
• https://github.com/inventree/InvenTree/pull/11581 · Correção
• https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037280574436762065 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-33530 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33530 · Nota de Segurança