Skip to content
Fencer Vulns
medium 6.4

CVE-2021-43781 json

Permissions not properly checked in Invenio-Drafts-Resources

published 2021-12-06 4 y ago modified 2026-07-08 4 mo ago also GHSA-xr38-w74q-r8jv , PYSEC-2021-836 , PYSEC-2021-837 , PYSEC-2021-838 , EUVD-2021-0102

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

Patch / fix

  • pypi invenio-drafts-resources 0.13.7, 0.14.6
  • pypi invenio-app-rdm 6.0.5, 7.0.0.dev5
  • pypi invenio-rdm-records 0.32.6, 0.33.10
  • inveniosoftware invenio-drafts-resources 0.13.7, 0.14.6

Exploit prediction

0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
GitHub 3.1 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi invenio-drafts-resources
<0.13.7
>=0.14.0, <0.14.6
0.13.7
0.14.6
pypi invenio-app-rdm
<6.0.5
>=7.0.0.dev0, <7.0.0.dev5
6.0.5
7.0.0.dev5
pypi invenio-rdm-records
<0.32.6
>=0.33.0, <0.33.10
0.32.6
0.33.10

Affected products

  • inveniosoftware invenio-drafts-resources

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.