CVE-2026-35479

OVERVIEW CVE-2026-35479 affects InvenTree, an open source inventory management system, in versions prior to 1.2.7 and 1.3.0. The vulnerability exists in the plugin installation functionality, where staff-level users can install arbitrary plugins via the API without requiring superuser permissions. This permission inconsistency is significant because other plugin operations, such as uninstallation, properly enforce superuser-only access controls. SEVERITY The vulnerability carries a CVSS v3.1 score of 4.7 (MEDIUM) with a network-based attack vector requiring high privileges but no user interaction. The impact is limited to low-level confidentiality, integrity, and availability concerns. While the attack requires staff account access, the ability to install arbitrary plugins could potentially allow malicious actors with staff privileges to introduce harmful code into the inventory management environment. EXPLOITATION STATUS There is no evidence of active exploitation, as this vulnerability is not included in CISA's Known Exploited Vulnerabilities (KEV) catalog and is not on the Hot List. No public exploit code appears to be readily available. Community attention remains minimal, reflected in the very low EPSS score of 0.00034, indicating this vulnerability ranks lower than 99.9 percent of all CVEs in terms of real-world exploitation probability.