This vulnerability allows an authenticated user to request reports or labels through the endpoints POST /api/report/print/ and POST /api/report/label/print/. The application does not enforce per-model permission checks before selecting objects by their primary key, consequently the user can enumerate object identifiers and retrieve reports containing purchase, sales, part, bill‑of‑materials, stock, build, supplier, customer, pricing, and inventory information that other APIs would normally deny. The primary impact is confidentiality loss through unintended disclosure of sensitive business data; there is no evidence of integrity or availability impact in the supplied description. The flaw represents a combination of weaknesses identified by CWE‑639 and CWE‑862, both involving improper authorization controls.

All installations of the InvenTree inventory management system running any version earlier than 1.4.0 are affected. The vulnerability exists in the core API endpoints that handle report and label generation, regardless of custom configuration or deployment environment. The vendor reported the issue to the open‑source community and the fix was released with release 1.4.0.

The CVSS score of 4.3 indicates a moderate severity. EPSS is not published, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in CISA’s KEV catalog. Because the flaw is exercised only after authentication, the most likely attack vector is a compromised or intentionally misconfigured authenticated session over the network. An attacker who obtains valid credentials can enumerate entity identifiers and download arbitrary reports, exposing sensitive data. The risk is therefore moderate with potential for significant data exposure if default templates are enabled and the user roles are insufficiently restrictive.