CVE-2026-33530

The record

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, certain API endpoints associated with bulk data operations can be hijacked to exfiltrate sensitive information from the database. The bulk operation API endpoints (e.g. `/api/part/`, `/api/stock/`, `/api/order/so/allocation/`, and others) accept a filters parameter that is passed directly to Django's ORM queryset.filter(**filters) without any field allowlisting. This enables any authenticated user to traverse model relationships using Django's __ lookup syntax and perform blind boolean-based data extraction. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

Affected packages

Related vulnerabilities

• CVE-2026-16520 Improper input validation and Exposure of sensitive information through data queries… CWE-202
• CVE-2026-25703 NeuVector through 5.4.9 is can potentially leak information from manager /network/graph… CWE-202
• CVE-2026-70473 Flowise is a drag-and-drop user interface for building customized large language model… CWE-202
• CVE-2026-42797 Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. CWE-202
• CVE-2026-40245 Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core… CWE-202
• CVE-2026-30778 The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration… CWE-202
• CVE-2026-3546 The e-shot form builder plugin for WordPress is vulnerable to Sensitive Information… CWE-202
• GHSA-6497-prx7-gpmq geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure CWE-202