Executive brief
InvenTree is an open-source inventory management system that tracks parts, stock, builds, and supplier information. Prior to version 1.4.0, users with restricted or no permissions could bypass access controls to enumerate object identifiers and download sensitive reports containing purchasing, sales, pricing, and inventory data that the system should have denied them access to.
Technical details
The ReportPrint and LabelPrint API endpoints at POST /api/report/print/ and POST /api/report/label/print/ perform authentication but skip permission checks via users.permissions.check_user_permission before accessing objects by primary key. An attacker can leverage default templates to render reports on any business model (part, stock, build, bill-of-materials, purchase order, sales order, supplier, customer, pricing data) without the VIEW permission that detail APIs enforce. The vulnerability is fixed in version 1.4.0 by adding permission validation before report generation.
Affected products
- InvenTree InvenTree before 1.4.0
Timeline
- 2026-09-21: disclosed
- 2026-06-10: patched: Fix merged in PR #12142 to version 1.4.0