CVE-2026-35478

InvenTree, an open-source inventory management system, contains a critical authentication bypass vulnerability (CVE-2026-35478) affecting versions 0.16.0 through 1.2.6. The flaw allows any authenticated user to generate valid API tokens impersonating arbitrary users, including administrators and superusers, by submitting a target user ID in a token creation request. The vulnerability presents a high-severity risk with a CVSS score of 8.1, requiring only network access and low privileges to exploit. The attack has low complexity and no user interaction requirement, enabling attackers to achieve full API authentication as any user from any location. This results in high confidentiality and integrity impacts, potentially allowing unauthorized access to sensitive inventory data and system modifications. There is no current evidence of active exploitation in the wild, and the vulnerability is not included on the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.0005 indicates minimal probability of exploitation relative to other CVEs, and community attention remains low. Organizations should prioritize patching to version 1.2.7 or 1.3.0 to remediate this issue before threat actors develop exploitation capabilities.