CVE-2021-43781

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

• CWE-862
• CWE-863

• https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626Patch, Third Party Advisory
• https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jvExploit, Third Party Advisory
• https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626Patch, Third Party Advisory
• https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jvExploit, Third Party Advisory

Published

Dec 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43776Backstage is an open platform for building developer portals…6.1
• CVE-2021-43777Redash is a package for data visualization and sharing. In R…6.1
• CVE-2021-43778Barcode is a GLPI plugin for printing barcodes and QR codes.…7.5
• CVE-2021-43779GLPI is an open source IT Asset Management, issue tracking s…9.9
• CVE-2021-4378The WP Quick FrontEnd Editor plugin for WordPress is vulnera…5.4
• CVE-2021-43780Redash is a package for data visualization and sharing. In v…8.8
• CVE-2021-43782Tuleap is a Libre and Open Source tool for end to end tracea…7.2
• CVE-2021-43783@backstage/plugin-scaffolder-backend is the backend for the …8.5
• CVE-2021-43784runc is a CLI tool for spawning and running containers on Li…5
• CVE-2021-43785@joeattardi/emoji-button is a Vanilla JavaScript emoji picke…6.1
• CVE-2021-43786Nodebb is an open source Node.js based forum software. In af…7.5
• CVE-2021-43787Nodebb is an open source Node.js based forum software. In af…6.1