InvenTree up to 1.2.5 API Endpoint /api/part/ filters information exposure

Summaryinfo

A vulnerability has been found in InvenTree up to 1.2.5 and classified as problematic. This affects an unknown function of the file /api/part/ of the component API Endpoint. This manipulation of the argument filters causes information exposure. This vulnerability appears as CVE-2026-33530. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in InvenTree up to 1.2.5 and classified as problematic. Affected by this vulnerability is an unknown part of the file /api/part/ of the component API Endpoint. The manipulation of the argument filters with an unknown input leads to a information exposure vulnerability. The CWE definition for the vulnerability is CWE-202. When trying to keep information confidential, an attacker can often infer some of the information by using statistics. As an impact it is known to affect confidentiality. The summary by CVE is:

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-33530 since 03/20/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 1.2.6 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• InvenTree

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5

Website

• Product: https://github.com/inventree/InvenTree/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion