PT-2026-31436 · Inventree · Inventree

CVE-2026-35479 · Published 2026-04-08 · Updated 2026-04-08

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.2.7 and 1.3.0

Description InvenTree versions before 1.2.7 and 1.3.0 allow staff users with staff access permissions to install plugins via the API without superuser access. This bypasses the usual security measures requiring superuser privileges for plugin installation, potentially enabling the installation of harmful plugins. The API endpoint used for plugin installation does not properly enforce the necessary permission checks.

Recommendations Update to InvenTree version 1.2.7 or 1.3.0.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-35479

GHSA-7C3Q-VWCV-2VP7

Affected Products

Inventree

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35479.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35479 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35479 · Vendor Advisory
• https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7 · Note
• https://t.me/CVEtracker/50087 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2042006227702464960 · Twitter Post
• https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust · Note
• https://docs.inventree.org/en/stable/start/config/#plugin-options · Note