InvenTree exposes plugin metadata through unauthenticated GET endpoints. The PluginSettingList, PluginAllSettingList, and PluginSettingDetail views omit the IsAuthenticated permission, allowing any caller to retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values via /api/plugin/settings/. Secret values remain masked, so the issue is confined to metadata disclosure. This satisfies CWE‑200 (Sensitive Information Exposure) and CWE‑862 (Missing Authentication). The risk is that an attacker could leverage disclosed configuration to craft further attacks or identify weaknesses in included plugins.

Users of the open‑source InvenTree inventory management system running any version prior to 1.4.0 are affected. The vulnerability was fixed in the 1.4.0 release, so upgrading to that or a newer version removes the flaw.

The CVSS score of 5.3 indicates moderate severity. With no authentication required, an attacker can simply issue a GET request to the affected /api endpoints, and the EPSS score is not available, so the exact exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Because the flaw only exposes non‑secret configuration, the immediate threat is limited to information disclosure, but it could assist in threat modeling or privilege escalation when combined with other system weaknesses.