The vulnerability allows users with staff-level permissions in InvenTree to install plugins through the API without requiring superuser rights. This deviation from the expected privilege model permits the deployment of arbitrary or malicious plugins, potentially enabling an attacker to execute arbitrary code, modify inventory data, or disrupt operations. The weakness is categorized as CWE‑285, Abuse of Privilege. If exploited, the attacker can gain administrative influence over the system’s plugins, leading to confidentiality, integrity, and availability impacts.

Any InvenTree installation running a version earlier than 1.2.7 for the 1.2 series or earlier than 1.3.0 for the 1.3 series is vulnerable. The issue is specific to the InvenTree product. Users should verify the deployed version and ensure they are running a patched release.

The CVSS score of 6.6 indicates moderate severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog, suggesting limited evidence of recent exploitation. The attack likely proceeds via an authenticated API call made by a staff user; no external network escalation is required beyond the existing staff credentials. The exploitability is therefore contingent on staff accounts having active API access, which many installations provide for routine operations.