CVE-2026-61746: InvenTree Information Disclosure Vulnerability

CVE-2026-61746 Overview

InvenTree is an open source inventory management system used by manufacturing and warehousing teams. Versions prior to 1.4.0 expose plugin configuration metadata through unauthenticated API endpoints. The PluginSettingList, PluginAllSettingList, and PluginSettingDetail views set GlobalSettingsPermissions without the IsAuthenticated permission applied to equivalent global-settings endpoints. Because GlobalSettingsPermissions returns true for safe HTTP methods and AuthRequiredMiddleware exempts /api/ paths, unauthenticated callers can retrieve plugin names, setting keys, descriptions, types, choices, and non-secret configuration values. Protected secret values remain masked as three asterisks. The issue is classified as [CWE-200] Information Exposure and is fixed in version 1.4.0.

Critical Impact
Unauthenticated remote attackers can enumerate installed plugins and read non-secret configuration values through /api/plugin/settings/ and per-plugin settings endpoints, aiding reconnaissance for follow-on attacks.

Affected Products

InvenTree versions prior to 1.4.0
InvenTree backend API endpoints /api/plugin/settings/ and per-plugin settings routes
Deployments relying on AuthRequiredMiddleware for /api/ protection

Discovery Timeline

2026-09-21 - CVE-2026-61746 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61746

Vulnerability Analysis

The vulnerability resides in the Django REST Framework permission classes assigned to plugin settings views in the InvenTree backend. The affected views declare GlobalSettingsPermissions as the sole permission class. That class returns True for safe HTTP methods such as GET, HEAD, and OPTIONS and does not require an authenticated session.

InvenTree normally enforces authentication for browser sessions through AuthRequiredMiddleware. That middleware exempts requests to /api/ paths because the API is expected to enforce its own authentication through DRF permission classes. The plugin settings views therefore fall into a gap between the two enforcement layers.

An unauthenticated caller can query /api/plugin/settings/ and receive a listing of plugin names, setting keys, descriptions, value types, permissible choices, and current non-secret values. Secret values remain masked as ***, limiting the disclosure to configuration metadata rather than credentials.

Root Cause

The root cause is an inconsistent permission policy. Equivalent global-settings endpoints combine GlobalSettingsPermissions with IsAuthenticated, while the plugin settings views omit the authentication requirement. The two layers of protection each assume the other enforces authentication.

Attack Vector

Exploitation requires only network reachability to the InvenTree API. An attacker sends an unauthenticated GET request to the plugin settings endpoints. No user interaction, credentials, or privileges are required.

python

 import structlog
 from django_q.models import OrmQ
 from drf_spectacular.utils import OpenApiParameter, OpenApiResponse, extend_schema
-from rest_framework import serializers, viewsets
+from rest_framework import permissions, serializers, viewsets
 from rest_framework.generics import GenericAPIView
 from rest_framework.request import clone_request
 from rest_framework.response import Response

The patch imports the permissions module so the plugin settings views can attach IsAuthenticated alongside GlobalSettingsPermissions. Source: GitHub Commit 6c18e64.

Detection Methods for CVE-2026-61746

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/plugin/settings/ in web server or reverse proxy logs
Requests to per-plugin settings endpoints originating from IP addresses that never authenticated
Sudden bursts of enumeration traffic against /api/plugin/ routes from a single source

Detection Strategies

Review reverse proxy and Django access logs for 2xx responses to plugin settings paths where the request lacks a session cookie or API token
Compare the running InvenTree version against the fixed release by querying /api/ for the INVENTREE_API_VERSION value and flagging any version below 506
Correlate unauthenticated plugin metadata reads with subsequent authenticated write attempts, which may indicate reconnaissance preceding exploitation

Monitoring Recommendations

Enable request logging with client IP, path, response code, and authentication status for all /api/ traffic
Forward InvenTree API logs to a centralized SIEM and alert on anonymous access to settings endpoints
Track plugin inventory changes so that newly disclosed plugin names can be reconciled with expected deployments

How to Mitigate CVE-2026-61746

Immediate Actions Required

Upgrade InvenTree to version 1.4.0 or later, which raises INVENTREE_API_VERSION to 506 and enforces IsAuthenticated on plugin settings endpoints
Restrict network access to the InvenTree API using a reverse proxy or firewall rules until the upgrade is applied
Rotate any secrets or API tokens whose existence or configuration keys may have been disclosed to untrusted parties

Patch Information

The fix is included in InvenTree 1.4.0 through pull request #12168 and commit 6c18e64. Release notes are published in the 1.4.0 release tag, and the coordinated disclosure is documented in GHSA-45f6-v6jq-99f7.

Workarounds

Place InvenTree behind a reverse proxy that requires authentication for /api/plugin/settings/ and related paths
Enforce IP allow-listing so that only trusted client networks can reach the API surface
Audit installed plugins and remove any that store non-secret configuration values that would be sensitive if disclosed

bash

# NGINX example restricting plugin settings endpoints to internal networks
location ~ ^/api/plugin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://inventree_backend;
}