---
id: CVE-2026-61746
title: InvenTree is an Open Source Inventory Management System
summary: >-
  InvenTree is an Open Source Inventory Management System. Prior to 1.4.0,
  PluginSettingList, PluginAllSettingList, and PluginSettingDetail set
  GlobalSettingsPermissions without the IsAuthenticated permission used by the
  project default an…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-200
  - CWE-862
vendor: inventree
product: InvenTree
affected:
  - InvenTree < 1.4.0
published: '2026-09-21'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:30:42.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61746'
references:
  - url: >-
      https://github.com/inventree/InvenTree/commit/6c18e6402005c0f105f88dfba4aaa11cf990a7e0
    label: security-advisories@github.com
  - url: 'https://github.com/inventree/InvenTree/pull/12168'
    label: security-advisories@github.com
  - url: 'https://github.com/inventree/InvenTree/releases/tag/1.4.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7
    label: security-advisories@github.com
  - url: >-
      https://github.com/inventree/InvenTree/security/advisories/GHSA-45f6-v6jq-99f7
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00397
epssPercentile: 0.31089
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T19:05:53.635224Z'
ingestedAt: '2026-09-21T19:51:58.860Z'
---

## Overview

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.