CVE-2026-35476

High

Published: 08 April 2026

Published

08 April 2026

Modified

21 April 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0003 10.4th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-35476 is a high-severity Improper Authorization (CWE-285) vulnerability in Inventree Project Inventree. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

AC-3 enforces approved authorizations for logical access, directly preventing non-staff users from modifying their own staff status via the misconfigured API endpoint.

AC-6 Least Privilege good match

prevent

AC-6 employs least privilege, ensuring users only have authorized privileges and blocking unauthorized self-elevation to staff level.

AC-2 Account Management partial match

prevent

AC-2 manages information system accounts including privilege assignments and reviews, mitigating unauthorized changes to user staff status through procedural controls.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

The vulnerability is an improper authorization flaw in the user accounts API that directly allows an authenticated non-staff user to modify their own staff status via POST, resulting in unauthorized privilege escalation to staff level.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API…

endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

Deeper analysisAI

CVE-2026-35476 is an improper authorization vulnerability (CWE-285) affecting InvenTree, an open-source inventory management system. In versions prior to 1.2.7 and 1.3.0, the API endpoint for user accounts has misconfigured write permissions, enabling a non-staff authenticated user to elevate their privileges to staff level by sending a POST request to modify their own account's staff status. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and was published on 2026-04-08.

Any authenticated non-staff user can exploit this issue remotely with low complexity, without user interaction, by targeting the vulnerable API endpoint with a crafted POST request to set their staff status. Successful exploitation results in privilege escalation, granting the attacker staff-level access, which could lead to unauthorized data access or modification (low confidentiality and integrity impact) within the scope of changed privileges.

The InvenTree GitHub security advisory (GHSA-r8q5-3595-3jh2) and documentation on assumed trust models detail the issue, confirming the fix in versions 1.2.7 and 1.3.0. Administrators should upgrade to these patched releases to mitigate the vulnerability.