InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed t…

CVE-2026-35478 affects InvenTree Open Source Inventory Management System versions 0.16.0 to before 1.2.7. Any authenticated user can create valid API tokens for other users, including administrators and superusers, by supplying the target's user ID in a POST request to /api/user/tokens/. The generated token provides immediate full API authentication as the target user from any network location without further interaction. This represents a critical privilege escalation vulnerability that allows authenticated attackers to impersonate any user in the system. The vulnerability is fixed in versions 1.2.7 and 1.3.0.