A critical authorization bypass vulnerability in InvenTree allows authenticated users to escalate privileges by hijacking the API tokens of any other user in the system.

This vulnerability, categorized as CWE-639, involves an improper authorization check within the API token generation logic. By submitting a crafted POST request to the /api/user/tokens/ endpoint, an authenticated user can impersonate any other account, including superusers, by specifying their user ID.

The vulnerability poses a severe risk to organizational data integrity and system security. Because an attacker can generate a valid token for an administrator, they can gain full unauthorized access to the inventory management system, potentially leading to unauthorized data modification, exfiltration, or complete system compromise. With a CVSS score of 8.3, this flaw represents a high risk to business continuity and operational security.

Immediate Action: Upgrade InvenTree to version 1.2.7 or 1.3.0 immediately to apply the necessary authorization logic fixes.

Proactive Monitoring: Review API access logs for anomalous requests directed at the /api/user/tokens/ endpoint, particularly those involving unexpected user ID associations.

Compensating Controls: If immediate patching is not feasible, restrict network access to the API endpoints to trusted IP ranges and monitor user account activity for suspicious configuration changes or unauthorized administrative actions.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

Given the ability for standard users to escalate privileges to administrative status, this vulnerability must be treated with high priority. Organizations using InvenTree should verify their current version and initiate the update process to version 1.2.7 or higher immediately. Failure to address this flaw leaves the entire inventory system susceptible to total compromise by any internal user.