CVE-2026-35478

Katalog CVE

CVSS 8.1 · High EPSS 0,43%

Kerentanan Authorization Bypass Through User-Controlled Key pada inventree project inventree. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed to any other user in the system — including administrators and superusers — by supplying the target's user ID in the user field of a POST /api/user/tokens/ request. The returned token is immediately usable for full API authentication as the target user, from any network location, with no further interaction required. This vulnerability is fixed in 1.2.7 and 1.3.0.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 36,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg advisory pihak ketiga