A misconfigured API endpoint in InvenTree allows any authenticated non‑staff user to change their own staff flag via a POST request to the user account endpoint. This improper write permission results in unauthorized elevation of privileges, effectively granting the attacker full administrative control over the system. The weakness is categorized as CWE‑285: Improper Authorization.

The vulnerability affects InvenTree installations running any version before 1.2.7 or 1.3.0. The affected product is the open source inventory management system developed by Inventree, Inc. No other versions or products are listed as impacted.

The CVSS score of 7.2 indicates a high severity issue. EPSS data is unavailable, but the lack of an official CISA KEV listing does not diminish the risk; the flaw can be exploited by any user who can obtain a normal account. The likely attack vector is a remote HTTP API request, requiring only authentication as a regular user. Once the exploit is executed, the attacker immediately gains staff privileges, compromising confidentiality, integrity, and availability of the entire system.