An authorization bypass vulnerability in InvenTree allows low-privileged authenticated users to exfiltrate sensitive inventory, pricing, and order data.

The application fails to perform adequate per-model authorization checks when processing barcode requests via the /api/barcode/ endpoint. An authenticated user can supply synthesized JSON payloads to enumerate database records and disclose sensitive information across multiple modules, including parts, stock, and orders.

The vulnerability poses a significant risk to data confidentiality by exposing commercially sensitive information, such as supplier pricing, customer details, and build configurations. Given the CVSS score of 6.5, the risk is classified as medium; however, the potential for mass enumeration of internal business data represents a substantial threat to organizational intellectual property and supply chain security.

Immediate Action: Upgrade the InvenTree installation to version 1.4.0 or later immediately to apply the required authorization logic.

Proactive Monitoring: Review audit logs for anomalous patterns in barcode API requests, specifically looking for high-frequency enumeration attempts targeting primary keys.

Compensating Controls: Implement strict access control lists or Web Application Firewall rules to restrict access to the /api/barcode/ endpoint to only authorized service accounts or administrative roles.

Public Exploit Available: No

Organizations utilizing InvenTree must treat this vulnerability with high priority, as it allows for the silent exfiltration of proprietary business data. Administrators should coordinate an immediate update to version 1.4.0 to ensure that proper authorization checks are enforced for all API interactions involving barcode processing.