InvenTree Privilege Escalation Vulnerability via API

A privilege escalation vulnerability has been identified in InvenTree, an open-source inventory management system, affecting versions prior to 1.2.7 and 1.3.0. The vulnerability allows non-staff authenticated users to elevate their account to staff level by sending a POST request to their user account endpoint. This issue arises from improper configuration of write permissions on the API endpoint, enabling any user to modify their staff status. The vulnerability requires valid user authentication to exploit, but the attack complexity is low.

Impact

Exploitation of this vulnerability allows non-staff authenticated users to gain staff privileges, which can lead to unauthorized access to sensitive features and data within the InvenTree application.

Remediation

Users can upgrade to InvenTree versions 1.2.7 or 1.3.0 to address this vulnerability.