InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations.
This issue is fixed in version 1.4.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/inventree/InvenTree/commit/29b8ed91d22e7471a75c1197cd8f45a13…
security-advisories@github.com
https://github.com/inventree/InvenTree/pull/12197
security-advisories@github.com
https://github.com/inventree/InvenTree/releases/tag/1.4.0
security-advisories@github.com
https://github.com/inventree/InvenTree/security/advisories/GHSA-c9wp-mw98-gfrj
security-advisories@github.com