CVE-2021-41189

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.

• CWE-863
• CWE-863

• https://github.com/DSpace/DSpace/commit/277b499a5cd3a4f5eb2370513a1b7e4ec2a6e041Patch, Third Party Advisory
• https://github.com/DSpace/DSpace/commit/c3bea16ab911606e15ae96c97a1575e1ffb14f8aPatch, Third Party Advisory
• https://github.com/DSpace/DSpace/issues/7928Exploit, Third Party Advisory
• https://github.com/DSpace/DSpace/security/advisories/GHSA-cf2j-vf36-c6w8Third Party Advisory
• https://github.com/DSpace/DSpace/commit/277b499a5cd3a4f5eb2370513a1b7e4ec2a6e041Patch, Third Party Advisory
• https://github.com/DSpace/DSpace/commit/c3bea16ab911606e15ae96c97a1575e1ffb14f8aPatch, Third Party Advisory
• https://github.com/DSpace/DSpace/issues/7928Exploit, Third Party Advisory
• https://github.com/DSpace/DSpace/security/advisories/GHSA-cf2j-vf36-c6w8Third Party Advisory

Published

Oct 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41183jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41184jQuery-UI is the official jQuery user interface library. Pri…6.1
• CVE-2021-41185Mycodo is an environmental monitoring and regulation system.…6.5
• CVE-2021-41186Fluentd collects events from various data sources and writes…7.5
• CVE-2021-41187DHIS 2 is an information system for data capture, management…8.8
• CVE-2021-41188Shopware is open source e-commerce software. Versions prior …5.4
• CVE-2021-4119bookstack is vulnerable to Improper Access Control9.8
• CVE-2021-41190The OCI Distribution Spec project defines an API protocol to…5
• CVE-2021-41191Roblox-Purchasing-Hub is an open source Roblox product purch…7.5
• CVE-2021-41192Redash is a package for data visualization and sharing. If a…6.5
• CVE-2021-41193wire-avs is the audio visual signaling (AVS) component of Wi…9.8
• CVE-2021-41194FirstUseAuthenticator is a JupyterHub authenticator that hel…9.8