CVE-2026-61746 in InvenTree
Summary
by MITRE • 09/21/2026
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified within InvenTree versions prior to 1.4.0 represents a significant authentication bypass affecting the API endpoints responsible for managing plugin settings. Specifically, the PluginSettingList, PluginAllSettingList, and PluginSettingDetail views were configured with GlobalSettingsPermissions rather than the IsAuthenticated permission class that is standard across other global-settings endpoints in the application architecture. This misconfiguration creates an inconsistency where certain administrative or configuration-related interfaces do not enforce mandatory user authentication checks before processing requests. The root cause lies in the specific permission classes assigned to these Django REST Framework views, which inadvertently allow access control logic to be bypassed for unauthenticated actors seeking information about plugin configurations.
From a technical perspective, GlobalSettingsPermissions is designed such that it returns true for safe HTTP methods like GET and HEAD without requiring explicit user authentication under certain conditions. This behavior interacts dangerously with the AuthRequiredMiddleware component of the InvenTree framework. The middleware exempts paths starting with /api/ from strict authentication requirements in specific contexts, effectively creating a gap where unauthenticated requests can reach the view logic before any further checks are applied. Consequently, an attacker who does not possess valid credentials or session tokens can interact directly with these endpoints to extract sensitive metadata about the system's plugin ecosystem.
The operational impact of this vulnerability centers on information disclosure and reconnaissance capabilities for potential attackers. By exploiting this flaw, an unauthenticated user can retrieve a comprehensive list of installed plugins along with their associated setting keys, descriptions, data types, available choices, and non-protected configuration values through endpoints such as /api/plugin/settings/ and per-plugin specific settings URLs. This exposure provides valuable intelligence regarding the internal structure and operational parameters of the inventory management system. While protected secret values remain masked as three asterisks to prevent direct credential theft, the disclosure of metadata can still facilitate further attacks by revealing how the system is configured, which plugins are active, and what configuration options are available for exploitation or social engineering purposes.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure to enforce authentication requirements on sensitive endpoints. It also maps to MITRE ATT&CK technique T1087 Account Discovery, as the attacker can enumerate system components and settings without authorization. The exposure of plugin metadata aids in mapping the attack surface of the application, allowing adversaries to identify potential entry points or misconfigurations that could be leveraged for more severe compromises such as privilege escalation or data exfiltration in subsequent stages of an intrusion campaign.
To mitigate this vulnerability, organizations running InvenTree must upgrade immediately to version 1.4.0 or later where the permission classes have been corrected to enforce IsAuthentication consistently across all global-settings endpoints. Until upgrading is possible, administrators should consider implementing network-level access controls such as firewall rules or reverse proxy configurations that restrict direct API access to authenticated IP ranges only. Additionally, enabling comprehensive logging and monitoring for unauthenticated requests targeting plugin settings endpoints can help detect exploitation attempts in real-time. Regular security audits of permission assignments across all API views are recommended to prevent similar inconsistencies from arising during future development cycles.