Executive brief
InvenTree is an open-source inventory management system used to track and organize product stock and supply chains. Prior to version 1.4.0, the data import API endpoints allowed any authenticated user to access import sessions belonging to other users, exposing sensitive staging data including row contents and column mappings. An attacker with any valid account could view another user's import data without permission.
Technical details
The /api/importer/row/ and /api/importer/mapping/ endpoints fail to enforce ownership checks on DataImportRow and DataImportColumnMap querysets, allowing any authenticated user to retrieve data from sessions owned by other users by supplying arbitrary session identifiers. The vulnerability requires authentication and affects data confidentiality rather than integrity or availability. A fix was released in version 1.4.0 by adding session ownership validation before returning user data.
Affected products
- InvenTree InvenTree before 1.4.0
Timeline
- 2026-09-21: disclosed
- 2026-06-15: patched: Fix merged in version 1.4.0