CVE-2026-35476 InvenTree Affected by Privilege Escalation via API
A non-staff user can escalate privileges to staff level by improperly modifying their own account status via the API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-35476?
CVE-2026-35476 is a high-severity vulnerability in InvenTree, published on 8 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.
Weakness: CWE-285
Which versions are affected by CVE-2026-35476?
It affects 1 product.
Products include Inventree Project Inventree.
How do I fix CVE-2026-35476?
No fix has been published for CVE-2026-35476 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-35476 being exploited?
There is no known exploitation of CVE-2026-35476 in the wild and no public exploit code.
Other vulnerabilities in InvenTree
- CVE-2022-2111 Unrestricted Upload of File with Dangerous Type in inventree/inventree
- CVE-2022-2112 Improper Neutralization of Formula Elements in a CSV File in inventree/inventree
- CVE-2022-2113 Cross-site Scripting (XSS) - Stored in inventree/inventree
- CVE-2026-35478 InvenTree has Arbitrary API Token Creation
- CVE-2022-3355 Cross-site Scripting (XSS) - Stored in inventree/inventree
Sources
Also known as GHSA-r8q5-3595-3jh2.