# CVE-2026-35476: InvenTree privilege escalation in user account API endpoint

Source: https://junglewise.ai/threats/cve-2026-35476-inventree-privilege-escalation-in-user-account-api-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-35476 · Severity: high · CVSS 7.2 · Published 2026-04-08

InvenTree, an open-source inventory management system, contains a security flaw that allows regular users to grant themselves administrative (staff) privileges. By sending a specially crafted request to the system's programming interface, a user can bypass intended restrictions and gain elevated control over the platform. This could allow an unauthorized individual to modify inventory records, access sensitive business data, or disrupt operations.

## Quick answers

**Is CVE-2026-35476 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35476 being exploited in the wild.

**How severe is CVE-2026-35476?** High severity, with a CVSS score of 7.2, published 8 April 2026.

**Which products and versions are affected?** InvenTree InvenTree < 1.2.7, < 1.3.0.

**Is there a fix for CVE-2026-35476?** A patch was published on 2026-04-08: Fixes released in versions 1.2.7 and 1.3.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35476 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35476?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A privilege escalation vulnerability exists in InvenTree due to improperly configured write permissions on the user account API endpoint. An authenticated user can submit a POST request to their own account endpoint to modify their 'is_staff' status, effectively elevating their privileges without administrative intervention. While the vendor's threat model assumes a level of trust for all users, this flaw allows a low-privileged actor to gain staff-level access. The issue is rooted in improper authorization (CWE-285) and is resolved in versions 1.2.7 and 1.3.0.

## Affected products

- InvenTree InvenTree < 1.2.7, < 1.3.0

## Timeline

- 2026-04-07: advisory: GitHub Security Advisory GHSA-r8q5-3595-3jh2 published
- 2026-04-08: disclosed: CVE-2026-35476 published to NVD
- 2026-04-08: patched: Fixes released in versions 1.2.7 and 1.3.0

## References

- [https://docs.inventree.org/en/stable/concepts/threat_model/](https://docs.inventree.org/en/stable/concepts/threat_model/)
- [https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2](https://github.com/inventree/InvenTree/security/advisories/GHSA-r8q5-3595-3jh2)