Platform
php
Component
inventree
Fixed in
1.2.8
CVE-2026-35476 describes a Privilege Escalation vulnerability discovered in InvenTree, an open-source inventory management system. This flaw allows a non-staff user, after authentication, to elevate their account privileges to a staff level, granting them broader access and control within the system. The vulnerability impacts versions 1.2.0 through 1.2.6 and is resolved in versions 1.2.7 and 1.3.0.
Successful exploitation of CVE-2026-35476 allows an attacker to bypass access controls and gain staff-level privileges within InvenTree. This could lead to unauthorized modification of inventory data, creation of new users with elevated permissions, and potentially complete control over the system's configuration. The impact is particularly severe as it requires only authentication, making it accessible to anyone who can log in to the system. A malicious insider or a compromised user account could leverage this vulnerability to cause significant disruption and data breaches.
CVE-2026-35476 was publicly disclosed on 2026-04-08. No public proof-of-concept (PoC) code has been released as of this writing. The vulnerability is not currently listed on CISA KEV, and its EPSS score is likely low given the lack of public exploitation. Monitor security advisories and threat intelligence feeds for any indications of active exploitation.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-35476 is to immediately upgrade InvenTree to version 1.2.7 or 1.3.0, which contains the fix. If upgrading is not immediately feasible, consider implementing stricter access controls and input validation on the user account endpoint. While not a complete solution, restricting write permissions on this endpoint can reduce the attack surface. Review InvenTree's API documentation for best practices on secure endpoint configuration. After upgrading, verify the fix by attempting to elevate a non-staff user account to staff status via a POST request to the user account endpoint; the request should be rejected.
Update InvenTree to version 1.2.7 or higher to fix the privilege escalation vulnerability. The update corrects the improper write permissions configuration on the API, preventing unauthorized users from changing their staff status.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-35476 is a vulnerability in InvenTree versions 1.2.0 through 1.2.6 that allows authenticated, non-staff users to elevate their account privileges to staff level, potentially granting unauthorized access.
You are affected if you are running InvenTree versions 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5, or 1.2.6. Upgrade to 1.2.7 or 1.3.0 to resolve the issue.
The recommended fix is to upgrade InvenTree to version 1.2.7 or 1.3.0. As a temporary workaround, restrict write permissions on the user account endpoint.
As of now, there are no confirmed reports of active exploitation of CVE-2026-35476, but it's crucial to apply the patch promptly.
Refer to the InvenTree security advisories on their official website or GitHub repository for the latest information and updates regarding CVE-2026-35476.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.