Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-21T18:17:09.253Z",
  "pubdate": "2026-09-21T18:17:09.253Z",
  "executiveSummary": "InvenTree versions prior to 1.4.0 contain an Improper Authorization vulnerability within the machine management API, specifically at the 'POST /api/machine/{pk}/restart/' endpoint.\nThe vulnerability allows any authenticated user—regardless of their assigned role or administrative permissions—to trigger a system-level restart of registered machines.\nThis flaw stems from an overly permissive access control configuration, specifically the use of 'IsAuthenticatedOrReadScope' instead of the required 'ADMIN' role enforcement.\nThe impact is significant, as it permits unauthorized users to interrupt active production, printing, or scanning operations, leading to potential data loss or operational downtime.\nThe vulnerability requires an authenticated session but does not necessitate high-privilege credentials, allowing low-privileged users (e.g., 'STOCK' role) to perform administrative actions.\nRisk implications include denial-of-service (DoS) against critical operational machinery and potential degradation of inventory management integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the incorrect implementation of access control decorators within 'src/backend/InvenTree/machine/api.py'. While other machine management operations in the InvenTree codebase correctly require administrative privileges, the 'restart' endpoint improperly utilizes 'IsAuthenticatedOrReadScope'.\nThis Django Rest Framework (DRF) permission class grants access to any user with a valid session who possesses read scope, failing to verify the specific 'ADMIN' role required for destructive or state-changing actions like machine restarts.\nThe attack flow proceeds as follows: An attacker with low-level authenticated access (e.g., a standard user assigned only a 'STOCK' role) initiates a POST request to '/api/machine/{pk}/restart/'.\nUpon receiving the request, the application backend fails to validate the user's role against the administrative policy. The backend logic then passes the request directly to the 'registry.restart_machine()' function.\nExecuting 'registry.restart_machine()' forces the designated machine identified by '{pk}' to undergo a hard restart. This action abruptly interrupts any currently running processes managed by the machine registry, such as active print jobs or automated scanning tasks.\nBecause the API does not enforce granular role-based access control (RBAC) at the endpoint level, there is no validation mechanism to ensure the user is an authorized administrator for the specific machine instance being targeted.\nThis behavior exposes a critical flaw in the authorization middleware where security constraints are bypassed due to improper permission class selection. The vulnerability affects all instances running versions prior to 1.4.0.\nPost-exploitation, the attacker can repeatedly trigger these restarts, resulting in persistent denial-of-service for any affected machine. This disrupts the inventory management workflow and creates a bottleneck in physical logistics and tracking operations linked to the InvenTree platform."
}