CVE-2026-35479 (GCVE-0-2026-35479)

Vulnerability from cvelistv5 – Published: 2026-04-08 19:27 – Updated: 2026-04-09 14:16
VLAI
Title
InvenTree Plugin Installation - Insufficient Permissions
Summary
InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring "superuser" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.
Severity
6.6 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
inventree InvenTree Affected: < 1.2.7
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-09T14:16:28.170445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-09T14:16:36.423Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "InvenTree",
          "vendor": "inventree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring \"superuser\" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T19:27:57.320Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7"
        },
        {
          "name": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust"
        },
        {
          "name": "https://docs.inventree.org/en/stable/start/config/#plugin-options",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.inventree.org/en/stable/start/config/#plugin-options"
        }
      ],
      "source": {
        "advisory": "GHSA-7c3q-vwcv-2vp7",
        "discovery": "UNKNOWN"
      },
      "title": "InvenTree Plugin Installation - Insufficient Permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-35479",
    "datePublished": "2026-04-08T19:27:57.320Z",
    "dateReserved": "2026-04-02T20:49:44.453Z",
    "dateUpdated": "2026-04-09T14:16:36.423Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-35479",
      "date": "2026-08-01",
      "epss": "0.00216",
      "percentile": "0.12158"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-35479\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-08T20:16:24.770\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring \\\"superuser\\\" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.\"},{\"lang\":\"es\",\"value\":\"InvenTree es un Sistema de Gesti\u00f3n de Inventario de C\u00f3digo Abierto. Antes de 1.2.7 y 1.3.0, cualquier usuario que tenga permisos de acceso de personal puede instalar plugins a trav\u00e9s de la API, sin requerir acceso a una cuenta de \u0027superusuario\u0027. Este nivel de requisito de permiso est\u00e1 desalineado con otras acciones de plugins (como la desinstalaci\u00f3n) que s\u00ed requieren acceso de superusuario. La vulnerabilidad permite a los usuarios de personal (a quienes se les puede considerar con un nivel de confianza inferior al de una cuenta de superusuario) instalar plugins arbitrarios (y potencialmente da\u00f1inos). Esta vulnerabilidad est\u00e1 corregida en 1.2.7 y 1.3.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"inventree\",\"product\":\"InvenTree\",\"versions\":[{\"version\":\"\u003c 1.2.7\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.3,\"impactScore\":3.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":3.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-09T14:16:28.170445Z\",\"id\":\"CVE-2026-35479\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:inventree_project:inventree:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.2.7\",\"matchCriteriaId\":\"8BE44F53-DDEE-4BA3-B8E3-1C88EBAB4DA0\"}]}]}],\"references\":[{\"url\":\"https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://docs.inventree.org/en/stable/start/config/#plugin-options\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:23:34+00:00",
      "cve": "CVE-2026-35479",
      "id": "CVE-2026-35479",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "InvenTree Plugin Installation - Insufficient Permissions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35479.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-35479\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-09T14:16:28.170445Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-09T14:16:32.301Z\"}}], \"cna\": {\"title\": \"InvenTree Plugin Installation - Insufficient Permissions\", \"source\": {\"advisory\": \"GHSA-7c3q-vwcv-2vp7\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"inventree\", \"product\": \"InvenTree\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.2.7\"}]}], \"references\": [{\"url\": \"https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7\", \"name\": \"https://github.com/inventree/InvenTree/security/advisories/GHSA-7c3q-vwcv-2vp7\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust\", \"name\": \"https://docs.inventree.org/en/stable/concepts/threat_model/#assumed-trust\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://docs.inventree.org/en/stable/start/config/#plugin-options\", \"name\": \"https://docs.inventree.org/en/stable/start/config/#plugin-options\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, any users who have staff access permissions can install plugins via the API, without requiring \\\"superuser\\\" account access. This level of permission requirement is out of alignment with other plugin actions (such as uninstalling) which do require superuser access. The vulnerability allows staff users (who may be considered to have a lower level of trust than a superuser account) to install arbitrary (and potentially harmful) plugins. This vulnerability is fixed in 1.2.7 and 1.3.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-285\", \"description\": \"CWE-285: Improper Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-08T19:27:57.320Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-35479\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-09T14:16:36.423Z\", \"dateReserved\": \"2026-04-02T20:49:44.453Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-08T19:27:57.320Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.