invenio-drafts-resources

Submission/deposit module for Invenio

View on Pypi

View on Github

Activity

Latest release: 2w ago
Total releases: 150
Cadence: ~11 days
Last 12 months: 15

Reach

Stars: 0

Details

License: MIT
First release: Jul 27, 2020

Releases

Version	Released
`10.1.1` patch	Aug 26, 2026
`11.0.3` patch	Aug 17, 2026
`11.0.2` patch	Aug 04, 2026
`10.1.0` minor	Jul 28, 2026
`10.0.1` patch	Jul 21, 2026
`11.0.1` patch	Jul 16, 2026
`11.0.0` major	Jun 17, 2026
`10.0.0` major	May 29, 2026
`9.0.2` patch	May 04, 2026
`9.0.1` patch	Apr 10, 2026
`9.0.0` major	Apr 07, 2026
`8.0.1` patch	Mar 10, 2026
`8.0.0` major	Jan 30, 2026
`7.3.1` patch	Dec 08, 2025
`7.3.0` minor	Nov 14, 2025
`7.2.0` minor	Jul 17, 2025
`7.1.2` patch	Jul 01, 2025
`7.1.1` patch	Jun 25, 2025
`7.1.0` minor	Jun 11, 2025
`7.0.0` major	Jun 03, 2025
`6.2.0` minor	May 23, 2025
`6.1.1` patch	May 07, 2025
`6.1.0` minor	May 07, 2025
`3.3.0` minor	Apr 29, 2025
`6.0.0` major	Dec 10, 2024
`5.1.0` minor	Aug 09, 2024
`3.2.0` minor	Jul 28, 2024
`5.0.0` major	Jul 04, 2024
`4.0.0` major	Jun 04, 2024
`3.1.1` patch	May 17, 2024
`3.1.0` minor	May 06, 2024
`3.0.0` major	Jan 31, 2024
`2.0.2` patch	Nov 07, 2023
`2.0.1` patch	Oct 26, 2023
`2.0.0` major	Oct 19, 2023
`1.13.1` patch	Oct 19, 2023
`1.13.0` minor	Oct 16, 2023
`1.12.2` patch	Oct 15, 2023
`1.12.1` patch	Oct 10, 2023
`1.12.0` minor	Oct 09, 2023
`1.11.2` patch	Oct 09, 2023
`1.11.1` patch	Oct 02, 2023
`1.11.0` minor	Sep 21, 2023
`1.10.1` patch	Sep 18, 2023
`1.10.0` minor	Sep 05, 2023
`1.9.0` minor	Sep 05, 2023
`1.0.6` patch	Aug 31, 2023
`1.0.5` patch	Aug 31, 2023
`1.8.1` patch	Aug 25, 2023
`1.8.0` minor	Aug 16, 2023

1–50 of 150

Repository

inveniosoftware/invenio-drafts-resources

Forks: 45
Open issues: 4
Language: Python

Dependencies (10)

Depends on

10.1.1

Used by

Supply-chain exposure

10 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2021-43781 GHSA-xr38-w74q-r8jv PYSEC-2021-836 PYSEC-2021-837 PYSEC-2021-838 Dec 06, 2021

Permissions not properly checked in Invenio-Drafts-Resources

Medium
Network Low Low

Impact

Invenio-Drafts-Resources does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. cannot change a record from restricted to public.

Details

The service's publish() method contains the following permission check:

def publish(..): self.require_permission(identity, "publish")

However, the record should have been passed into the permission check so that the need generators have access to e.g. the record owner.

def publish(..): self.require_permission(identity, "publish", record=record)

The bug is activated in Invenio-RDM-Records which has a need generator called RecordOwners(), which when no record is passed in defaults to allow any authenticated user:

class RecordOwners(Generator): def needs(self, record=None, **kwargs): if record is None: return [authenticated_user] # ...

Patches

The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6+, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

You can verify the version installed of Invenio-Drafts-Resources via PIP:

cd ~/src/my-site pipenv run pip freeze | grep invenio-drafts-resources

References

Security policy

For more information

If you have any questions or comments about this advisory:

Chat with us on Discord: https://discord.gg/8qatqBC

Affected versions

0.1.00.1.20.1.30.10.00.10.10.10.100.10.20.10.30.10.40.10.50.10.60.10.7

+ 53 more Show less

0.10.80.10.90.11.00.11.10.11.20.11.30.11.40.11.50.11.60.12.00.12.10.12.20.13.00.13.10.13.20.13.30.13.40.13.50.13.60.2.00.2.10.2.20.2.30.2.40.3.00.4.00.4.10.4.20.4.30.5.00.6.00.6.10.6.20.7.00.7.10.7.20.8.00.8.10.8.20.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.80.14.00.14.10.14.20.14.30.14.5

Fixed in

0.13.70.14.6

References

https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv
https://nvd.nist.gov/vuln/detail/CVE-2021-43781
https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626
https://github.com/pypa/advisory-database/tree/main/vulns/invenio-app-rdm/PYSEC-2021-837.yaml
https://github.com/pypa/advisory-database/tree/main/vulns/invenio-drafts-resources/PYSEC-2021-836.yaml

Updated Jul 08, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 11
minor 40
patch 98

150 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More