Executive brief
InvenTree, an open-source inventory management system, contains a flaw where users with standard "staff" permissions can install software plugins through the system's API. Normally, this action should be restricted to "superusers" with full administrative control. An authorized staff member could exploit this to install malicious plugins, potentially leading to data theft, system modification, or full server compromise.
Technical details
An improper authorization vulnerability (CWE-285) exists in InvenTree's plugin management API. Prior to versions 1.2.7 and 1.3.0, the API endpoint for installing plugins only validated that a user had 'staff' status rather than 'superuser' status. This is inconsistent with other administrative actions like uninstallation, which correctly require superuser privileges. A remote attacker with staff-level credentials can leverage this to install arbitrary plugins. Because InvenTree plugins can access the database, environment variables, and the underlying file system, this can lead to a full container or server compromise. The issue is resolved by enforcing superuser requirements for plugin installation.
Affected products
- InvenTree Project InvenTree < 1.2.7, < 1.3.0
Timeline
- 2026-04-07: advisory: GitHub Security Advisory GHSA-7c3q-vwcv-2vp7 published
- 2026-04-08: disclosed: CVE-2026-35479 published