---
id: CVE-2026-61747
title: InvenTree is an Open Source Inventory Management System
summary: >-
  InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the
  /api/importer/row/ and /api/importer/mapping/ endpoints do not scope
  DataImportRow and DataImportColumnMap querysets to the owner of the associated
  DataImportSe…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: inventree
product: InvenTree
affected:
  - InvenTree < 1.4.0
published: '2026-09-21'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:30:42.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-61747'
references:
  - url: >-
      https://github.com/inventree/InvenTree/commit/3c17367e3c2b23631a5d1d7d9b7d93c4174b8eb1
    label: security-advisories@github.com
  - url: 'https://github.com/inventree/InvenTree/pull/12169'
    label: security-advisories@github.com
  - url: 'https://github.com/inventree/InvenTree/releases/tag/1.4.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/inventree/InvenTree/security/advisories/GHSA-xjpv-cwpw-7qx8
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00342
epssPercentile: 0.24947
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-21T20:04:50.434899Z'
ingestedAt: '2026-09-21T19:51:58.860Z'
---

## Overview

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users, although the InvenTree threat model treats authenticated instance users as trusted. This issue is fixed in version 1.4.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.