CVE-2026-61746
mediumInvenTree is an Open Source Inventory Management System.
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0 security-advisories@github.com
- https://github.com/inventree/InvenTree/pull/12168 security-advisories@github.com
- https://github.com/inventree/InvenTree/releases/tag/1.4.0 security-advisories@github.com
- https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7 security-advisories@github.com
- https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7 134c704f-9b21-4f2e-91b3-4a467353bcc0