CVE-2026-33530
InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.7
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
- EPSS probability
- 0.20%
- CWE
- CWE-202
- Published
- 2026-03-26
- Last modified
- 2026-03-30
Affected products
- inventree InvenTree
Weakness type
Related vulnerabilities
- CVE-2026-16520 — Improper input validation and Exposure of sensitive information through data queries vulnerability...
- CVE-2026-25703 — Potential information leakage from manager /network/graph API in NeuVector
- CVE-2026-70473 — Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
- CVE-2026-42797 — Apache Syncope: JexlContextBuilder Information Disclosure
- CVE-2026-40245 — Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication
- CVE-2026-30778 — Apache SkyWalking: The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.
- CVE-2026-3546 — e-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via API Token via 'eshot_form_builder_get_account_data' AJAX Action
- CVE-2026-25050 — Vendure vulnerable to timing attack that enables user enumeration in NativeAuthenticationStrategy