Home / Vulnerability Intelligence / CVE-2026-35478

CVE-2026-35478 - Vulnerability Analysis

HighCVSS: 8.3

Last Updated: April 8, 2026

InvenTree - Authentication Bypass

Published: April 8, 2026Updated: April 8, 2026Remote Exploitable

Overview

InvenTree 0.16.0 to < 1.2.7 contains a broken authentication vulnerability caused by improper authorization in API token creation, letting authenticated users create tokens for any user including admins, exploit requires authentication.

Severity & Score

Severity: High

CVSS Score: 8.3

Impact

Authenticated attackers can impersonate any user, including administrators, gaining full API access and control over the system.

Mitigation

Upgrade to version 1.2.7 or later.

References

https://github.com/inventree/InvenTree/security/advisories/GHSA-qh5j-c28q-c4rg

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-35478
Severity: High
CVSS Score: 8.3
Type: broken_authentication
Status: unconfirmed

CWE

CWE-639

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L