The vulnerability is an Insecure Direct Object Reference that lets any authenticated InvenTree user retrieve the row_data, data fields, and column mappings of a DataImportSession owned by another user. By supplying another user’s session identifier to the /api/importer/row/ or /api/importer/mapping/ endpoints, an attacker can expose all information staged for import, potentially revealing sensitive inventory data treated as confidential. This flaw is classified as CWE‑639.

The issue affects all installations of InvenTree running a version earlier than 1.4.0. Every authenticated user who can call the protected API endpoints is at risk until the product is upgraded to the patched release.

The CVSS score of 4.3 indicates moderate severity, the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authenticated access and knowledge of another user’s DataImportSession ID, which can be discovered through normal API usage. Once the ID is known, the attacker can quietly retrieve the session’s row_data and mappings, enabling cross-user information disclosure. The vulnerability is not a remote code execution but provides substantial confidential data access across users.