CVE-2026-61748: InvenTree Authorization Bypass Vulnerability

CVE-2026-61748 Overview

InvenTree, an open source inventory management system, contains an Insecure Direct Object Reference (IDOR) vulnerability in its report and label printing APIs. The ReportPrint endpoint at POST /api/report/print/ and the LabelPrint endpoint at POST /api/report/label/print/ require authentication but fail to call users.permissions.check_user_permission before selecting objects by primary key. Authenticated users with unrelated roles can enumerate object identifiers and download rendered reports containing purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data. This flaw is tracked as [CWE-639: Authorization Bypass Through User-Controlled Key] and is resolved in InvenTree 1.4.0.

Critical Impact

Any authenticated InvenTree user, regardless of assigned role, can retrieve sensitive business data through rendered report and label templates that the corresponding detail APIs would deny.

Affected Products

• InvenTree versions prior to 1.4.0
• InvenTree ReportPrint API endpoint (/api/report/print/)
• InvenTree LabelPrint API endpoint (/api/report/label/print/)

Discovery Timeline

• 2026-09-21 - CVE-2026-61748 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-61748

Vulnerability Analysis

The vulnerability resides in the report and label printing APIs of InvenTree. Both endpoints authenticate the caller but omit a per-model view permission check before loading objects by primary key. InvenTree ships default templates for major business models, including parts, stock, builds, purchase orders, and sales orders. When the printing endpoint receives a request, it renders the referenced template against the requested object identifiers and stores the resulting file in DataOutput scoped to the requesting user. A role-less account, or one with an unrelated role, can iterate primary keys and retrieve reports containing data that the corresponding detail API would refuse to return. The rendered artifact effectively bypasses the object-level authorization enforced elsewhere in the platform.

Root Cause

The printing views did not invoke users.permissions.check_user_permission for the caller's view role on the target model before serializing objects into a template. Authentication was enforced, but authorization on the underlying model was not, matching the [CWE-639] pattern of authorization bypass through a user-controlled primary key.

Attack Vector

An authenticated attacker submits crafted POST requests to /api/report/print/ or /api/report/label/print/, supplying a template identifier plus one or more object primary keys. Because default templates exist for major business models, the attacker does not need to upload their own template. Iterating primary keys produces rendered artifacts that expose purchase, sales, pricing, supplier, customer, and inventory data.

# Security patch in src/backend/InvenTree/report/api.py
# Source: https://github.com/inventree/InvenTree/commit/73bfa53a35f67027132b9ef053d82aef033f7175
import django_filters.rest_framework.filters as rest_filters
from django_filters.rest_framework import DjangoFilterBackend
from django_filters.rest_framework.filterset import FilterSet
from rest_framework.exceptions import PermissionDenied
from rest_framework.generics import GenericAPIView
from rest_framework.response import Response

import InvenTree.permissions
import report.helpers
import report.models
import report.serializers
import users.permissions
from common.models import DataOutput
from common.serializers import DataOutputSerializer
from InvenTree.api import meta_path

The patch imports PermissionDenied and the users.permissions module so the printing views can validate the caller's per-model view role before rendering. The API version was incremented from 501 to 502 to signal the behavior change to clients.

Detection Methods for CVE-2026-61748

Indicators of Compromise

• Repeated POST requests to /api/report/print/ or /api/report/label/print/ from a single authenticated session with incrementing items primary keys.
• Successful report generation events attributed to accounts that lack view permissions for the referenced model.
• Unexpected growth in DataOutput records associated with low-privilege user accounts.

Detection Strategies

• Correlate authenticated user roles against the model types referenced in printing API calls and alert on mismatches.
• Baseline typical report-printing volume per user and flag statistical outliers, especially sequential primary-key enumeration.
• Review web server and application logs for POST /api/report/print/ and POST /api/report/label/print/ traffic paired with HTTP 200 responses to non-privileged accounts.

Monitoring Recommendations

• Enable verbose audit logging for InvenTree report and label endpoints and forward events to a centralized log platform.
• Monitor the DataOutput table for artifacts created by accounts outside the expected reporting user set.
• Track the INVENTREE_API_VERSION value in deployed instances to confirm they report version 502 or higher.

How to Mitigate CVE-2026-61748

Immediate Actions Required

• Upgrade InvenTree to version 1.4.0 or later, which introduces the check_user_permission call in the printing views.
• Audit user role assignments and remove unnecessary authenticated accounts, particularly service or integration users with no clear reporting need.
• Review historical DataOutput records for reports generated by accounts that should not have viewed the underlying models.

Patch Information

The fix is delivered in the InvenTree 1.4.0 release via pull request #12142 and commit 73bfa53. Refer to the GitHub Security Advisory GHSA-7w96-99fj-8g7x for the coordinated disclosure details.

Workarounds

• Restrict network access to the InvenTree API to trusted networks or VPN clients until the upgrade is deployed.
• Temporarily disable or restrict default report and label templates so that role-less accounts cannot render them.
• Enforce short session lifetimes and rotate API tokens for accounts that do not require reporting privileges.

# Verify the running InvenTree API version reports 502 or higher after upgrade
curl -s -H "Authorization: Token <API_TOKEN>" \
  https://<inventree-host>/api/ | grep -i version

# Upgrade using pip within the InvenTree virtual environment
pip install --upgrade "inventree>=1.4.0"