CVE-2026-35479 inventree CVE debrief

Who should care

Users of InvenTree, especially those with staff access permissions, should be aware of this vulnerability and take necessary actions to update their systems. Affected operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability details and take appropriate measures to mitigate the risk.

Technical summary

InvenTree, an Open Source Inventory Management System, has a vulnerability that allows staff users to install plugins via the API without superuser access. This issue arises from the inconsistent permission requirements for plugin actions, where installing plugins does not require superuser access unlike uninstalling plugins. The vulnerability has a CVSS score of 6.6 and is classified as MEDIUM severity. The fix is available in versions 1.2.7 and 1.3.0 of InvenTree.

Defensive priority

Medium priority due to the potential for staff users to install harmful plugins.

Recommended defensive actions

• Update InvenTree to version 1.2.7 or 1.3.0
• Restrict plugin installation to superuser accounts
• Monitor plugin installations for suspicious activity
• Review and update user permissions
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed by the CVE record and NVD details. The fix is available in versions 1.2.7 and 1.3.0 of InvenTree. Staff users with specific permissions can install plugins via the API without requiring superuser account access, which may lead to the installation of arbitrary and potentially harmful plugins. Evidence limits suggest that the affected scope and severity are based on the CVE record and NVD details. Defenders should verify the affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources