VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 6, 2021· Updated Aug 4, 2024

Permissions not properly checked in Invenio-Drafts-Resources

CVE-2021-43781

Description

Invenio-Drafts-Resources fails to check record ownership on publish, allowing authenticated users to publish others' drafts if they know the record ID.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Invenio-Drafts-Resources fails to check record ownership on publish, allowing authenticated users to publish others' drafts if they know the record ID.

Vulnerability

Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The publish() method in the service layer calls self.require_permission(identity, "publish") without passing the record object, so the RecordOwners need generator defaults to allowing any authenticated user when no record is provided [1][2]. This affects default installations of InvenioRDM.

Exploitation

An authenticated attacker can publish draft records of other users via REST API calls if they know the record identifier and the draft validates (e.g., all required fields are filled). No special privileges or user interaction is required beyond authentication [1][2].

Impact

The attacker gains the ability to publish another user's draft record, making it publicly visible (or visible according to the record's access settings). However, the attacker cannot modify the data in the record, so they cannot change access restrictions (e.g., from restricted to public) [1][2].

Mitigation

The issue is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which are included in InvenioRDM v6.0.1 and v7.0 respectively [1][2]. Users should upgrade to these versions. There is no known workaround.

References
  1. NVD - CVE-2021-43781
  2. Permissions not properly checked when a record is published.

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
invenio-drafts-resourcesPyPI
< 0.13.70.13.7
invenio-app-rdmPyPI
< 6.0.56.0.5
invenio-rdm-recordsPyPI
< 0.32.60.32.6
invenio-drafts-resourcesPyPI
>= 0.14.0, < 0.14.60.14.6
invenio-rdm-recordsPyPI
>= 0.33.0, < 0.33.100.33.10
invenio-app-rdmPyPI
>= 7.0.0.dev0, < 7.0.0.dev57.0.0.dev5

Affected products

4

Patches

1
039b0cff1ad4

security: fix missing permission check of publish

https://github.com/inveniosoftware/invenio-drafts-resourcesLars Holm NielsenNov 24, 2021via ghsa
commit
1 file changed · +1 −2
  • invenio_drafts_resources/services/records/service.py+1 −2 modified
    @@ -267,10 +267,9 @@ def publish(self, id_, identity, uow=None):
               into records)
             - Create or update associated (published) record with data
         """
-        self.require_permission(identity, "publish")
-
         # Get the draft
         draft = self.draft_cls.pid.resolve(id_, registered_only=False)
+        self.require_permission(identity, "publish", record=draft)
 
         # Validate the draft strictly - since a draft can be saved with errors
         # we do a strict validation here to make sure only valid drafts can be

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.