CVE-2026-61748

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0

Description An authentication bypass occurs because the system fails to call the users.permissions.check user permission() function to verify the caller's per-model view role before selecting objects by primary key and rendering them. This allows authenticated users with no roles or unrelated roles to enumerate object identifiers and download reports containing sensitive purchase, sales, part, bill-of-materials, stock, build, supplier, customer, pricing, and inventory data. The issue affects the following API endpoints:

Recommendations Update to version 1.4.0.