CVE-2026-33530

Katalog CVE

CVSS 6.5 · Medium EPSS 0,20%

Kerentanan Exposure of Sensitive Information Through Data Queries pada inventree project inventree. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

Rincian

Terbit di NVD

26 Maret 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-202: Exposure of Sensitive Information Through Data Queries

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/inventree/InvenTree/security/advisories/GHSA-m8j2-vfmq-p6qg advisory vendor
• https://github.com/inventree/InvenTree/pull/11581 issue tracking · patch