InvenTree versions prior to 1.2.6 are vulnerable to sensitive data exfiltration by authenticated users due to improper input validation in the bulk API endpoints.

This vulnerability arises from a lack of field allowlisting in API endpoints that accept filter parameters, which are passed directly to the Django ORM. Any authenticated user can leverage Django's lookup syntax to perform blind boolean-based extraction of sensitive database information.

The ability for authenticated users to extract arbitrary database information poses a significant risk to data confidentiality and organizational privacy. Given the CVSS score of 7.7, this is a high-severity issue that could lead to the unauthorized exposure of inventory, supplier, or order data, potentially resulting in compliance failures or operational disruption.

Immediate Action: Update the InvenTree installation to version 1.2.6 or 1.3.0 immediately to implement the required filter allowlisting.

Proactive Monitoring: Review API access logs for anomalous requests containing complex filter strings or unexpected lookup syntax patterns, such as double underscores, in the query parameters.

Compensating Controls: While no direct workarounds are available, administrators should restrict API access to trusted users and ensure the instance is not exposed to the public internet without robust authentication and network-level access controls.

Public Exploit Available: No (the available data does not confirm the existence of a public exploit).

This vulnerability represents a serious risk to the confidentiality of sensitive inventory management data. Administrators must prioritize updating to version 1.2.6 or higher to ensure proper validation logic is applied to all API filter parameters. Failure to patch leaves the backend database exposed to unauthorized data extraction by any authenticated user on the system.