CVE-2026-61745: InvenTree Auth Bypass Vulnerability

CVE-2026-61745 Overview

InvenTree is an open source inventory management system used by manufacturers, warehouses, and workshops. Versions prior to 1.4.0 contain a missing authorization flaw [CWE-862] in the machine management API. The POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py applies the IsAuthenticatedOrReadScope permission instead of the ADMIN role required by other machine management operations. Any authenticated user, including a warehouse operator holding only the STOCK role, can invoke registry.restart_machine() on any registered machine. The result is a status reset that interrupts active printing, scanning, or other machine operations.

Critical Impact

Low-privileged authenticated users can restart any registered machine, disrupting active label printing, barcode scanning, and other integrated hardware workflows.

Affected Products

• InvenTree versions prior to 1.4.0
• InvenTree backend component src/backend/InvenTree/machine/api.py
• Deployments exposing the machine registry API to non-admin authenticated users

Discovery Timeline

• 2026-09-21 - CVE-2026-61745 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61745

Vulnerability Analysis

The flaw is a broken access control issue in the InvenTree REST API. The machine restart endpoint uses a permission class that only verifies the caller is authenticated. Other machine management endpoints require the ADMIN role, so restart is inconsistent with the surrounding authorization model. An authenticated user with the STOCK role, typically assigned to warehouse staff, can send a POST request to /api/machine/{pk}/restart/ and cause the backend to call registry.restart_machine() for any machine primary key. Restarting a machine resets its status and interrupts operations in progress, such as label printer jobs or barcode scanner sessions.

Root Cause

The view guarding POST /api/machine/{pk}/restart/ was decorated with IsAuthenticatedOrReadScope rather than the admin-scoped permission class applied to sibling machine endpoints. This omission allowed any authenticated session to reach the restart action regardless of assigned role.

Attack Vector

Exploitation requires a valid authenticated session and network access to the InvenTree API. No user interaction is required and the attack complexity is low. The impact is limited to availability of machine operations; confidentiality and integrity of stored data are not affected.

# Source: https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd
# Patch in src/backend/InvenTree/machine/api.py - imports the standard
# DRF permissions module so the restart view can enforce staff access.
from django.urls import include, path, re_path

from drf_spectacular.utils import extend_schema
from rest_framework import permissions
from rest_framework.exceptions import NotFound
from rest_framework.response import Response
from rest_framework.views import APIView

# Source: https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd
# API version bump in src/backend/InvenTree/InvenTree/api_version.py
# documents the new staff requirement on the machine restart endpoint.
INVENTREE_API_VERSION = 510

v510 -> 2026-06-18 : https://github.com/inventree/InvenTree/pull/12197
    - Require "staff" access permissions for the machine restart API endpoint

Detection Methods for CVE-2026-61745

Indicators of Compromise

• HTTP POST requests to /api/machine/{pk}/restart/ originating from user sessions that do not hold the ADMIN role.
• Unexpected machine status resets in InvenTree logs correlated with active print or scan jobs failing mid-operation.
• Repeated restart calls against multiple machine primary keys from a single session, indicating enumeration.

Detection Strategies

• Enable request logging on the InvenTree backend and filter for the machine/restart path, then join with user role metadata to surface non-admin callers.
• Alert on API responses of 200 from the restart endpoint that are not preceded by administrative activity from the same session.
• Correlate machine driver status transitions with the initiating API caller to identify unauthorized restart sources.

Monitoring Recommendations

• Ship InvenTree application logs and reverse proxy access logs to a centralized log platform for retention and query.
• Track baseline restart frequency per machine and alert on statistically anomalous spikes.
• Monitor for InvenTree instances still reporting API version below 510 after the patch window.

How to Mitigate CVE-2026-61745

Immediate Actions Required

• Upgrade InvenTree to version 1.4.0 or later, which enforces staff permissions on the machine restart endpoint.
• Audit assigned roles and remove unnecessary API access for accounts that do not require machine control.
• Rotate API tokens for accounts that may have been used to probe the endpoint prior to patching.

Patch Information

The fix is delivered in InvenTree 1.4.0 via GitHub Pull Request #12197 and commit 29b8ed9. The patch bumps the API version from 509 to 510 and requires staff access permissions for the machine restart endpoint. Additional context is available in the GitHub Security Advisory GHSA-c9wp-mw98-gfrj and the InvenTree 1.4.0 release notes.

Workarounds

• Restrict network access to the /api/machine/ path at a reverse proxy or web application firewall, allowing only administrative source addresses until patching completes.
• Temporarily disable machine driver integrations that are not actively required, reducing the impact of an unauthorized restart.
• Reduce role assignments so that only trusted operators hold authenticated sessions against the InvenTree API.

# Example nginx rule blocking non-admin networks from the machine restart endpoint
location ~ ^/api/machine/[0-9]+/restart/$ {
    allow 10.0.10.0/24;   # admin management subnet
    deny  all;
    proxy_pass http://inventree_backend;
}