The vulnerability in InvenTree allows an authenticated user to craft filter queries that are directly forwarded to Django's ORM without any field allowlisting. Because no allowlist is enforced, the attacker can traverse model relationships using the __ lookup syntax and perform blind boolean-based extraction, effectively retrieving arbitrary data from the database. This results in unauthorized disclosure of sensitive inventory information and corresponds to CWE-202.

InvenTree inventory management system, versions prior to 1.2.6 and any 1.3.x releases earlier than 1.3.0 are affected. The issue applies to API endpoints used for bulk operations such as parts, stock, and order allocations. Updating to version 1.2.6 or later, or 1.3.0 and above, removes the flaw.

The CVSS base score of 7.7 indicates a high risk environment. However, the EPSS score is below 1% and the vulnerability is not listed in the KEV catalog, suggesting limited exploitation in the wild at present. Attacking requires valid authentication and API access, and the lack of a workaround means that only patching mitigates the risk.