CVE-2026-61745
4.3 MEDIUMpublic exploit availablePublished 2026-09-21 · Updated 2026-09-21
AI risk analysis
- Summary
- The flaw allows any authenticated user to restart any machine, even without ADMIN role, by exploiting a misconfigured API endpoint in InvenTree versions prior to 1.4.0.
- Exploitability
- Exploitation is relatively easy as it requires only an authenticated session with STOCK or higher role. Precondition is the target machine must be registered and accessible via the API.
- Blast radius
- If exploited, this can significantly disrupt operations by resetting machine status and interrupting ongoing processes like printing or scanning.
- Prioritized remediation
- Upgrade to InvenTree version 1.4.0 or later to apply the necessary fix.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-862
Public exploit & PoC references
- https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd
- https://github.com/inventree/InvenTree/pull/12197
- https://github.com/inventree/InvenTree/releases/tag/1.4.0
- https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj
- https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj
All references
- https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13ad40fdd
- https://github.com/inventree/InvenTree/pull/12197
- https://github.com/inventree/InvenTree/releases/tag/1.4.0
- https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj
- https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2026-16102
- HIGHCVE-2026-55997PoC
- MEDIUMCVE-2026-58271PoC
- MEDIUMCVE-2026-75158PoC
- HIGHCVE-2026-77560PoC
- CRITICALCVE-2026-15958
- HIGHCVE-2026-16561
- HIGHCVE-2026-16605
Related by shared AI tags and CWE weakness class. Browse the full archive.