Description

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPermissions without the IsAuthenticated permission used by the project default and equivalent global-settings endpoints. GlobalSettingsPermissions returns true for safe methods, while AuthRequiredMiddleware exempts /api/ paths, so an unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values through /api/plugin/settings/ and the per-plugin settings endpoints. Protected secret values remain masked as three asterisks, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-21T19:17:07.453Z",
  "pubdate": "2026-09-21T19:17:07.453Z",
  "executiveSummary": "InvenTree versions prior to 1.4.0 contain an Improper Authorization vulnerability within the plugin settings API endpoints. The flaw allows unauthenticated remote attackers to bypass intended access controls and retrieve sensitive plugin configuration metadata.\nThe vulnerability stems from the use of the GlobalSettingsPermissions class, which incorrectly permits read access to unauthenticated requests via safe HTTP methods (e.g., GET) for specific API paths. While protected secret keys remain masked with asterisks, the exposure includes internal plugin names, setting keys, descriptions, data types, and non-sensitive configuration values.\nThe vulnerability affects PluginSettingList, PluginAllSettingList, and PluginSettingDetail components. Successful exploitation does not require prior authentication, exposing internal architectural details that could facilitate further reconnaissance against the InvenTree instance.\nRisk implications include information disclosure regarding the system's plugin ecosystem, which may reveal internal workflows or environment-specific configurations. Users are advised to upgrade to version 1.4.0 or later to ensure that the appropriate authentication middleware is enforced across all administrative API endpoints.",
  "technicalDetails": "The vulnerability is rooted in an authorization bypass within the InvenTree API framework, specifically affecting endpoints associated with plugin settings: /api/plugin/settings/ and associated per-plugin configuration paths.\nThe root cause is an inconsistent implementation of access control decorators. While the project default and standard global-settings endpoints correctly require the IsAuthenticated permission, the PluginSettingList, PluginAllSettingList, and PluginSettingDetail viewsets utilize a custom GlobalSettingsPermissions class. This class is designed to return true for 'safe' HTTP methods, such as GET, which effectively grants public access to these read-only operations.\nThe exploitation flow is facilitated by the interaction between this misconfigured permission class and the project's AuthRequiredMiddleware. Because the AuthRequiredMiddleware exempts /api/ paths from standard session-based authentication requirements, the application relies entirely on the view-level permission class to validate the request. By sending an unauthenticated GET request to the affected API endpoints, an attacker can enumerate the full plugin configuration schema.\nThe payload response includes, but is not limited to, the following sensitive metadata: plugin identification names, specific setting keys, descriptive text, data type definitions, allowed value choices, and the current state of non-protected configuration variables. Although the system architecture attempts to mitigate the impact by masking 'secret' or sensitive configuration values with three asterisks (***), the exposure of plugin-specific metadata provides an attacker with deep insights into the server's operational environment.\nThe vulnerability is strictly limited to metadata and non-sensitive configuration disclosure; however, the exposure of plugin names and specific settings can provide an attacker with a blueprint of the system's capabilities, potentially identifying which third-party integrations or internal customizations are active. This reconnaissance phase is a precursor to more targeted exploitation if specific plugins are found to have further vulnerabilities. The issue was addressed in version 1.4.0 by replacing the weak GlobalSettingsPermissions implementation with the standard IsAuthenticated permission, ensuring that all GET requests to plugin configuration endpoints are properly gated by the authentication middleware."
}