CVE-2026-61747: InvenTree Information Disclosure Vulnerability

CVE-2026-61747 Overview

InvenTree, an open source inventory management system, contains an Insecure Direct Object Reference (IDOR) vulnerability in its data importer API. The /api/importer/row/ and /api/importer/mapping/ endpoints fail to scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including accounts without assigned roles, can supply another user's import session identifier. The attacker then retrieves that session's row_data, data fields, and column mappings. The issue is fixed in version 1.4.0. The InvenTree threat model treats authenticated instance users as trusted, which limits real-world exposure to environments with untrusted internal users.

Critical Impact
Authenticated low-privilege users can read staged import data and column mappings belonging to other users, exposing sensitive contents queued for import.

Affected Products

InvenTree versions prior to 1.4.0
InvenTree /api/importer/row/ endpoint
InvenTree /api/importer/mapping/ endpoint

Discovery Timeline

2026-09-21 - CVE-2026-61747 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61747

Vulnerability Analysis

The vulnerability is an Authorization Bypass Through User-Controlled Key issue classified as [CWE-639]. InvenTree's data importer feature stages user-uploaded rows and column mappings in DataImportRow and DataImportColumnMap models tied to a DataImportSession. The affected API viewsets return objects filtered only by the session primary key supplied in the request. They do not check whether the requesting user owns the parent session. An authenticated user can enumerate or guess session IDs and read data staged by other users, including data queued for models the caller has no role permission to view.

Root Cause

The root cause is missing ownership enforcement on queryset filtering in src/backend/InvenTree/importer/api.py. The endpoints exposed staged import artifacts without verifying session.user == request.user or staff status. Staged rows and column mappings were also retained after import completion, extending the window of exposure.

Attack Vector

Exploitation requires an authenticated session against the InvenTree instance. The attacker issues authenticated HTTP requests to /api/importer/row/ or /api/importer/mapping/ supplying another user's DataImportSession primary key. The API returns the staged row data and field mappings without authorization checks. No user interaction is required beyond the attacker's own authentication.

python

# Security patch applied in src/backend/InvenTree/importer/api.py (PR #12169)
"""Accept the field mapping for a DataImportSession."""
session = get_object_or_404(importer.models.DataImportSession, pk=pk)

# Check session ownership
if not request.user.is_staff and session.user != request.user:
    raise PermissionDenied()

# Check that the user has permission to accept the field mapping
if model_class := session.model_class:
    if not check_user_permission(request.user, model_class, 'change'):
        ...

Source: GitHub Commit 3c17367

Detection Methods for CVE-2026-61747

Indicators of Compromise

Authenticated API requests to /api/importer/row/ or /api/importer/mapping/ referencing session IDs that do not belong to the requesting user.
Unexpected read activity from low-privilege accounts against importer endpoints.
Enumeration patterns showing sequential or brute-forced DataImportSession primary keys.

Detection Strategies

Correlate API access logs with DataImportSession.user ownership records to flag cross-user reads.
Alert on accounts with no assigned roles issuing requests to importer API paths.
Baseline expected importer usage per user and identify statistical outliers.

Monitoring Recommendations

Enable verbose logging on the InvenTree backend for /api/importer/* endpoints, including requesting user ID and target session ID.
Forward web server and application logs to a centralized analytics platform for retention and query.
Review historical logs prior to upgrade for evidence of cross-user session access.

How to Mitigate CVE-2026-61747

Immediate Actions Required

Upgrade InvenTree to version 1.4.0 or later, which enforces session ownership checks on importer endpoints.
Audit existing DataImportSession records for unexpected access before completing the upgrade.
Review user accounts and remove or disable inactive or unnecessary authenticated users.

Patch Information

The fix is included in InvenTree Release v1.4.0 via Pull Request #12169. Details are documented in GitHub Security Advisory GHSA-xjpv-cwpw-7qx8. The patch adds PermissionDenied enforcement when session.user != request.user and deletes staging rows and column mappings once an import completes.

Workarounds

Restrict access to the InvenTree instance to trusted users only, consistent with the project's stated threat model.
Temporarily disable use of the data importer feature until the upgrade is applied.
Place the InvenTree API behind network access controls or a reverse proxy that limits importer endpoint access to trusted operators.

bash

# Upgrade InvenTree to the patched release
pip install --upgrade "inventree>=1.4.0"

# Or with Docker
docker pull inventree/inventree:1.4.0
docker compose up -d