CVE-2026-35479

Katalog CVE

CVSS 4.7 · Medium EPSS 0,37%

Kerentanan Improper Authorization pada inventree project inventree. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.

Rincian

Terbit di NVD

8 April 2026

Terakhir diubah

6 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7 advisory pihak ketiga
• https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust product
• https://docs.inventree.org/en/stable/start/config/#plugin-options product