Executive brief
InvenTree is an open-source inventory management system. Prior to version 1.4.0, its plugin settings API endpoints did not require user authentication, allowing unauthenticated attackers to retrieve plugin names, configuration keys, descriptions, and non-secret settings values. While protected secret values remain masked, this exposes sensitive system metadata that could inform further attacks.
Technical details
The PluginSettingList, PluginAllSettingList, and PluginSettingDetail API endpoints use GlobalSettingsPermissions without IsAuthenticated requirement, combined with AuthRequiredMiddleware exempting /api/ paths, allowing unauthenticated access to /api/plugin/settings/. An attacker gains disclosure of plugin metadata and configuration values (excluding masked secrets) via network-based API calls. The issue is fixed in version 1.4.0 by adding explicit permission checks.
Affected products
- InvenTree InvenTree prior to 1.4.0
Timeline
- 2026-09-21: disclosed
- 2026-06-15: patched: Fixed in version 1.4.0