Executive brief
InvenTree, an open-source inventory management system, contains a security flaw that allows any logged-in user to impersonate any other user, including administrators. By sending a specifically crafted request, an attacker can generate a secret access key for another person's account. This allows the attacker to view sensitive inventory data, modify records, or take full control of the system as an administrator.
Technical details
An authorization bypass vulnerability (CWE-639) exists in InvenTree's API token generation endpoint. The root cause is a failure to validate that the authenticated user requesting a token matches the user ID provided in the request body. An attacker with low-level authenticated access can send a POST request to /api/user/tokens/ containing the user ID of a target (such as a superuser). The system then returns a valid API token for that target user. This token can be used immediately for full API authentication from any location without further interaction. The issue is fixed in versions 1.2.7 and 1.3.0.
Affected products
- InvenTree InvenTree >= 0.16.0, < 1.2.7
Timeline
- 2026-04-07: advisory: GitHub Security Advisory published
- 2026-04-08: disclosed: CVE published to NVD