PT-2026-31435 · Inventree · Inventree

Published 2026-04-08 · Updated 2026-04-08 · CVE-2026-35478

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions InvenTree versions 0.16.0 through 1.2.6

Description An authenticated InvenTree user can create a valid API token for any other user, including administrators and superusers, by providing the target user's ID in the user field of a POST request to the /api/user/tokens/ API endpoint. The generated token allows full API authentication as the target user from any network location without further interaction.

Recommendations Update to version 1.2.7 or 1.3.0.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-35478

Affected Products

Inventree

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35478 · Security Note
• https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg · Note
• https://twitter.com/VulmonFeeds/status/2042011347634798868 · Twitter Post
• https://t.me/CVEtracker/50086 · Telegram Post