CVE-2026-61744

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0

Description An issue exists where the POST /api/barcode/ endpoint accepts synthesized internal JSON barcodes containing a lowercase model label and an integer primary key. Because the BarcodeView only requires authentication or a general read scope, and the InvenTreeBarcodeMixin.format matched response() function returns the complete model serializer output without verifying the caller's per-model view role, low-privilege users can enumerate primary keys. This allows the disclosure of sensitive information regarding parts, stock, locations, supplier and manufacturer parts, orders, and builds, including pricing and customer data.

Recommendations Update to version 1.4.0.