Executive brief
InvenTree is an open-source inventory management system that integrates with hardware devices like barcode scanners and 3D printers. A vulnerability in versions prior to 1.4.0 allows any authenticated warehouse worker to restart connected machines without proper authorization, potentially interrupting critical operations and disrupting business workflows.
Technical details
The POST /api/machine/{pk}/restart/ endpoint in InvenTree uses insufficient permission checks (IsAuthenticatedOrReadScope) instead of requiring ADMIN role, allowing authenticated users without elevated privileges to trigger MachineRestart and invoke registry.restart_machine() on any registered machine. The vulnerability affects any authenticated user with limited roles like STOCK, and is fixed by restricting the endpoint to staff users only as of version 1.4.0.
Affected products
- InvenTree InvenTree prior to 1.4.0
Timeline
- 2026-09-21: disclosed
- 2026-06-18: patched