CVE-2026-35479 InvenTree Plugin Installation - Insufficient Permissions

Medium 6.6 Published 8 Apr 2026 Updated 9 Apr 2026

Staff users can install arbitrary plugins via the API without superuser privileges, potentially leading to code execution or privilege escalation.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-35479?

CVE-2026-35479 is a medium-severity missing authorization vulnerability in InvenTree, published on 8 Apr 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.

Weakness: CWE-285

Which versions are affected by CVE-2026-35479?

It affects 1 product.

Products include Inventree Project Inventree.

How do I fix CVE-2026-35479?

No fix has been published for CVE-2026-35479 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-35479 being exploited?

There is no known exploitation of CVE-2026-35479 in the wild and no public exploit code.

Sources

Also known as GHSA-7c3q-vwcv-2vp7.