PT-2026-28488 · Inventree · Inventree

Schrodingersgat · Published 2026-03-26 · Updated 2026-03-26 · CVE-2026-33530

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.2.6 InvenTree versions 1.2.6 through 1.3.0

Description InvenTree is an Open Source Inventory Management System. Certain API endpoints associated with bulk data operations can be exploited to exfiltrate sensitive information from the database. The bulk operation API endpoints, including /api/part/, /api/stock/, /api/order/so/allocation/, and others, accept a filters parameter. This parameter is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This allows authenticated users to traverse model relationships using Django's lookup syntax and perform blind boolean-based data extraction. The filters parameter is the key component in this issue.

Recommendations Update InvenTree to version 1.2.6 or later. Update InvenTree to version 1.3.0 or later.

Exploit

Fix

Weakness Enumeration

CWE-202

Related Identifiers

CVE-2026-33530

GHSA-M8J2-VFMQ-P6QG

Affected Products

Inventree

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33530.json · Exploit
• https://github.com/inventree/InvenTree/pull/11581 · Patch
• https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33530 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33530 · Security Note
• https://twitter.com/CVEnew/status/2037280574436762065 · Twitter Post