CVE-2026-61744: InvenTree Information Disclosure Vulnerability

CVE-2026-61744 Overview

InvenTree, an open source inventory management system, contains an Insecure Direct Object Reference [CWE-639] in the barcode API prior to version 1.4.0. The POST /api/barcode/ endpoint accepts an attacker-synthesized internal JSON barcode containing a model label and integer primary key. The BarcodeView enforces only IsAuthenticatedOrReadScope, so a low-privilege authenticated user can enumerate primary keys for parts, stock, locations, supplier and manufacturer records, orders, and builds. The built-in barcode plugin then returns the full model serializer output without verifying per-model view roles, disclosing commercially sensitive inventory, pricing, supplier, customer, and order data.

Critical Impact
Any authenticated low-privilege user can bypass per-model view roles and exfiltrate the complete serialized contents of internal InvenTree records via forged barcode payloads.

Affected Products

InvenTree Open Source Inventory Management System
All versions prior to 1.4.0
Deployments exposing POST /api/barcode/ to authenticated users with only general read scope

Discovery Timeline

2026-09-21 - CVE-2026-61744 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61744

Vulnerability Analysis

The vulnerability lives in InvenTree's barcode scanning API. BarcodeView accepts JSON payloads and delegates them to registered barcode plugins. The built-in plugin recognizes an internal JSON barcode format that references a database object by lowercase model label and integer primary key. The plugin resolves the object with model.objects.get(pk=...) and then invokes InvenTreeBarcodeMixin.format_matched_response(), which serializes the entire model instance into the response.

Because the endpoint uses the IsAuthenticatedOrReadScope permission class, any authenticated caller passes the check regardless of their per-model role assignments. The plugin never validates that the requester holds the corresponding view role for the target model. An attacker can iterate primary keys across models such as part, stockitem, stocklocation, supplierpart, manufacturerpart, purchaseorder, salesorder, and build to bulk-disclose sensitive records.

Root Cause

The root cause is missing object-level authorization in the barcode handler. Authentication is conflated with authorization, and the serializer output is returned without checking whether the calling user has the required view role for the referenced model.

Attack Vector

Exploitation requires network access to the API and a valid low-privilege account. The attacker crafts internal barcode JSON payloads specifying a target model and primary key, submits them to POST /api/barcode/, and reads back the serialized record. Primary key enumeration is trivial with sequential integers.

python

# Patch excerpt: src/backend/InvenTree/plugin/base/barcodes/api.py
 for current_plugin in plugins:
     try:
-        result = current_plugin.scan(barcode)
+        result = current_plugin.scan(barcode, user=request.user, **kwargs)
+    except PermissionDenied as exc:
+        raise exc
     except Exception:
         log_error('BarcodeView.scan_barcode', plugin=current_plugin.slug)
         continue

The fix propagates request.user into the plugin scan and allows plugins to raise PermissionDenied, which is re-raised instead of being swallowed by the generic exception handler. Source: GitHub commit f21bc2d.

Detection Methods for CVE-2026-61744

Indicators of Compromise

High-frequency POST /api/barcode/ requests from a single authenticated session, especially with sequential integer pk values.
Barcode payloads referencing internal model labels such as part, stockitem, purchaseorder, or supplierpart originating from users without corresponding view roles.
API responses returning full serializer output for models the requester cannot access through standard list or detail endpoints.

Detection Strategies

Parse InvenTree application logs for BarcodeView invocations and correlate the payload model and pk fields against the caller's assigned roles.
Baseline normal barcode scan volume per user and alert on statistical outliers indicative of enumeration.
Enable web application firewall rules that inspect JSON bodies to /api/barcode/ for internal model references submitted by non-privileged accounts.

Monitoring Recommendations

Forward InvenTree API logs and reverse-proxy access logs to a centralized analytics platform for anomaly detection on /api/barcode/.
Track authentication events tied to bursts of barcode scans and pivot on session identifiers to identify compromised low-privilege accounts.
Alert on serializer responses that include pricing, supplier, or customer fields returned to users lacking the corresponding role.

How to Mitigate CVE-2026-61744

Immediate Actions Required

Upgrade all InvenTree instances to version 1.4.0 or later without delay.
Audit user accounts and revoke unnecessary API tokens or read scopes granted to low-privilege users.
Review historical /api/barcode/ traffic for signs of enumeration and rotate credentials of any suspected accounts.

Patch Information

The issue is fixed in InvenTree 1.4.0. The patch introduces PermissionDenied handling in BarcodeView.scan_barcode and passes the request user into plugin scan functions so plugins can enforce per-model view roles. See the InvenTree 1.4.0 release notes, pull request #12233, and GitHub Security Advisory GHSA-6pm3-m334-mr4j.

Workarounds

Restrict network access to /api/barcode/ at a reverse proxy so only trusted operator accounts can reach the endpoint until upgrade.
Reduce the number of accounts holding a general read scope and require dedicated per-model roles for barcode-adjacent workflows.
Deploy WAF rules that drop POST /api/barcode/ requests containing raw internal JSON model references from non-privileged sessions.

bash

# Example nginx restriction until upgrade to 1.4.0
location = /api/barcode/ {
    allow 10.0.0.0/24;   # trusted operator subnet
    deny  all;
    proxy_pass http://inventree_backend;
}