Is CVE-2026-35479 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-35479 being exploited in the wild.

How severe is CVE-2026-35479?

Medium severity, with a CVSS score of 6.6, published 8 April 2026.

Which products and versions are affected?

InvenTree Project InvenTree < 1.2.7, < 1.3.0.

Is there a fix for CVE-2026-35479?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-35479 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-35479?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35479: InvenTree improper authorization for plugin installation via API

Q: Is there a fix for CVE-2026-35479?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-35479 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-35479?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-35479 · Severity: medium · CVSS 6.6 · Published 2026-04-08

InvenTree, an open-source inventory management system, contains a flaw where users with standard "staff" permissions can install software plugins through the system's API. Normally, this action should be restricted to "superusers" with full administrative control. An authorized staff member could exploit this to install malicious plugins, potentially leading to data theft, system modification, or full server compromise.

Quick answers

Is CVE-2026-35479 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-35479 being exploited in the wild.
How severe is CVE-2026-35479?: Medium severity, with a CVSS score of 6.6, published 8 April 2026.
Which products and versions are affected?: InvenTree Project InvenTree < 1.2.7, < 1.3.0.
Is there a fix for CVE-2026-35479?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-35479 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-35479?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability (CWE-285) exists in InvenTree's plugin management API. Prior to versions 1.2.7 and 1.3.0, the API endpoint for installing plugins only validated that a user had 'staff' status rather than 'superuser' status. This is inconsistent with other administrative actions like uninstallation, which correctly require superuser privileges. A remote attacker with staff-level credentials can leverage this to install arbitrary plugins. Because InvenTree plugins can access the database, environment variables, and the underlying file system, this can lead to a full container or server compromise. The issue is resolved by enforcing superuser requirements for plugin installation.

Affected products

InvenTree Project InvenTree < 1.2.7, < 1.3.0

Timeline

2026-04-07: advisory: GitHub Security Advisory GHSA-7c3q-vwcv-2vp7 published
2026-04-08: disclosed: CVE-2026-35479 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.