PT-2026-31435 · Inventree · Inventree

CVE-2026-35478 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions InvenTree versions 0.16.0 through 1.2.6

Description An authenticated InvenTree user can create a valid API token for any other user, including administrators and superusers, by providing the target user's ID in the user field of a POST request to the /api/user/tokens/ API endpoint. The generated token allows full API authentication as the target user from any network location without further interaction.

Recommendations Update to version 1.2.7 or 1.3.0.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-35478

GHSA-QH5J-C28Q-C4RG

Affected Products

Inventree

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35478.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-35478 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35478 · Security Note
• https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg · Note
• https://t.me/CVEtracker/50086 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2042011347634798868 · Twitter Post