Security Advisory

[SchrodingersGat]

We were recently made aware of a security issue that enables logging in to the API without MFA - even if configured - GHSA-2crp-q9pc-457j

It is strongly advised to update to the fixed versions 0.15.2 and 0.16.x and follow channels for similar security notices.

Further information about the 0.15.2 release is available here: https://github.com/inventree/InvenTree/releases/tag/0.15.2

---

We take security disclosures seriously, if you have a report to make, refer to our security policy.