A flaw in InvenTree’s machine restart API allows any user who can authenticate to the system to trigger a restart of any registered machine. The endpoint was protected only by an authentication check and did not enforce the ADMIN role required for other machine‑management actions. An attacker could therefore force a machine to reset at will, halting active printing, scanning or other operations and causing a denial of service to the production line.

The vulnerability affects InvenTree versions prior to 1.4.0. Users running releases older than 1.4.0 are at risk, regardless of their role assignment, including those with only STOCK privileges in the warehouse module. The issue is resolved in version 1.4.0 and later releases.

The CVSS score of 4.3 indicates low severity. Because the attack requires only routine authentication and no elevated privileges, exploitation is relatively straightforward for any user with access to the system. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, so the measured likelihood of exploitation is currently unknown.