CVE-2026-35478: InvenTree Authentication Bypass Vulnerability

CVE-2026-35478 Overview

CVE-2026-35478 is a critical Insecure Direct Object Reference (IDOR) vulnerability affecting InvenTree, an Open Source Inventory Management System. The vulnerability allows any authenticated InvenTree user to create a valid API token attributed to any other user in the system—including administrators and superusers—by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required.

Critical Impact

Complete privilege escalation allowing any authenticated user to impersonate administrators and superusers with full API access, enabling unauthorized data access, modification, and system compromise.

Affected Products

• InvenTree versions 0.16.0 through 1.2.6
• InvenTree versions prior to 1.3.0
• All deployments using the vulnerable /api/user/tokens/ endpoint

Discovery Timeline

• 2026-04-08 - CVE-2026-35478 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-35478

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), a form of Insecure Direct Object Reference (IDOR). The flaw exists in InvenTree's API token generation endpoint, which fails to properly validate that the requesting user has authorization to create tokens for the specified user ID. When an authenticated user sends a POST request to /api/user/tokens/ with a user field containing another user's ID, the system generates and returns a valid API token for that target user without verifying the requester's authority to perform this action.

The vulnerability requires only low-privilege authenticated access to exploit, operates over the network without any user interaction, and provides immediate high-impact results. An attacker can escalate from a basic user account to full administrative access in a single API request.

Root Cause

The root cause is a missing authorization check in the token generation endpoint. The application accepts the user parameter from the request body and uses it directly to create an API token without verifying that the authenticated user making the request is authorized to generate tokens for the specified user ID. Proper implementation would either restrict users to generating tokens only for their own accounts or implement role-based access controls to determine who can create tokens for other users.

Attack Vector

The attack is executed via network-accessible API requests. An attacker with any valid InvenTree user credentials can:

1. Authenticate to the InvenTree API using their own credentials
2. Enumerate or guess valid user IDs (often sequential integers starting from 1)
3. Send a POST request to /api/user/tokens/ with the user field set to an administrator's user ID
4. Receive a valid API token that provides full access as the targeted administrator
5. Use the token from any network location to perform privileged operations

The attack requires no user interaction and the generated token works immediately. The exploitation is straightforward, requiring only basic HTTP request crafting capabilities. The attacker can target superuser accounts (typically user ID 1) to gain maximum privileges.

Detection Methods for CVE-2026-35478

Indicators of Compromise

• Unexpected API token creation events in audit logs where the user field differs from the authenticated session user
• Multiple token generation requests targeting administrative or superuser account IDs
• API tokens being used from unusual IP addresses or geolocations for privileged accounts
• Sudden increase in API token generation activity from low-privilege user accounts

Detection Strategies

• Monitor the /api/user/tokens/ endpoint for POST requests where the authenticated user differs from the user ID in the request body
• Implement alerting on token generation events targeting user IDs with administrative privileges
• Review access logs for patterns of sequential user ID enumeration followed by token generation attempts
• Deploy web application firewall rules to flag suspicious token creation patterns

Monitoring Recommendations

• Enable comprehensive audit logging for all token generation and authentication events
• Configure SIEM rules to correlate token creation with subsequent privileged API access from new sources
• Implement anomaly detection for API token usage patterns, particularly for administrator accounts
• Set up alerts for API token generation requests that specify user IDs different from the requesting user

How to Mitigate CVE-2026-35478

Immediate Actions Required

• Upgrade InvenTree to version 1.2.7 or 1.3.0 or later immediately
• Audit existing API tokens and revoke any suspicious or unauthorized tokens
• Review access logs to identify potential exploitation attempts
• Temporarily disable the /api/user/tokens/ endpoint if immediate patching is not possible

Patch Information

InvenTree has addressed this vulnerability in versions 1.2.7 and 1.3.0. The fix implements proper authorization checks to ensure users can only generate API tokens for their own accounts. Organizations should update to the latest patched version as soon as possible. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement network-level access controls to restrict access to the InvenTree API to trusted networks only
• Use a reverse proxy or web application firewall to block or monitor requests to /api/user/tokens/ that contain a user field in the request body
• Disable API token generation functionality entirely if not operationally required until patching is complete
• Enforce additional authentication factors for administrative account access

# Example: Nginx configuration to block suspicious token requests
# Add to your InvenTree server block configuration
location /api/user/tokens/ {
    # Restrict access to trusted internal networks only
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    
    # Forward to InvenTree backend
    proxy_pass http://inventree_backend;
}