CVE-2026-61747

Summary

The flaw allows any authenticated user to access another user's import session data, exposing sensitive information. This matters because it breaches data privacy despite users being considered trusted within the InvenTree system.

Exploitability

Exploitation is relatively easy as long as an attacker has an authenticated session and knows the target import session identifier.

Blast radius

If exploited, this could lead to unauthorized access to sensitive import data across multiple users, impacting data privacy and security within the InvenTree system.

Prioritized remediation

Upgrade to InvenTree version 1.4.0 or apply the relevant patch to secure import session data access.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.