PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35478 inventree CVE debrief

CVE-2026-35478 is a high-severity vulnerability in InvenTree, an Open Source Inventory Management System. An authenticated user can create a valid API token for any other user, including administrators and superusers, by providing the target user's ID in a POST /api/user/tokens/ request. The returned token allows for full API authentication as the target user from any network location without further interaction. This issue is fixed in versions 1.2.7 and 1.3.0.

Vendor
inventree
Product
Unknown
CVSS
HIGH 8.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Organizations using InvenTree versions between 0.16.0 and 1.2.6 should prioritize patching to prevent unauthorized access. Security teams and administrators of InvenTree instances are particularly concerned.

Technical summary

The vulnerability exists in the API token creation endpoint of InvenTree. By manipulating the user field in a POST request to /api/user/tokens/, an authenticated user can generate a valid API token for another user. This token grants full API access as the target user, posing a significant risk of lateral movement and privilege escalation within the system. The issue arises from insufficient access controls and improper validation of user input in the token generation process.

Defensive priority

High priority should be given to patching InvenTree instances, as this vulnerability allows for significant lateral movement and privilege escalation. Immediate action is recommended for systems exposed to untrusted networks or users.

Recommended defensive actions

  • Apply patches: Upgrade to InvenTree version 1.2.7 or 1.3.0 to fix the vulnerability.
  • Inventory and monitor: Identify and monitor all InvenTree instances, especially those exposed to untrusted networks or users.
  • Restrict access: Implement additional access controls and network restrictions to limit exposure to the InvenTree API.
  • Audit tokens: Regularly audit and revoke any suspicious or unused API tokens.
  • User awareness: Educate users about the risks of sharing or exposing API tokens and the importance of secure practices.

Evidence notes

The CVE record was published on 2026-04-08T20:16:24.630Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 8.3 and is classified as HIGH severity. A Third Party Advisory is available from GitHub.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T20:16:24.630Z and has not been modified since then. The NVD entry is currently Analyzed.