A crafted POST request to the /api/barcode/ endpoint can send an internal JSON payload that includes a model label and primary key. Because the API does not enforce the specific view role on the model, the response contains the full serialized data, exposing sensitive inventory, pricing, supplier, customer, and order information to any authenticated user. This violation stems from improper authority checks (CWE‑639) and inadequate access control over serialized data (CWE‑863), as the protection relies solely on authentication or a general read scope and fails to enforce per‑model view role constraints, allowing low‑privilege actors to enumerate numerous objects across parts, stock, locations, suppliers, and builds.

The vulnerability applies to the open‑source InvenTree Inventory Management System, as shipped before version 1.4.0. Any deployment that has not yet upgraded to 1.4.0 is susceptible, regardless of the specific instance or plugins in use. The affected areas include models for parts, stock, locations, supplier and manufacturer parts, orders, and builds.

The CVSS score is 6.5, indicating a moderate severity. No EPSS score is published, and the flaw is not currently listed in CISA’s KEV catalog, suggesting limited known exploitation. However, the attack path is straightforward: a remote attacker who can authenticate with a low‑privilege account can send the malformed payload and receive detailed system information. Because the data is returned as JSON over the API, the attacker gains complete visibility into unusually sensitive operational data that would otherwise be restricted by more granular view roles.