Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

OpenCloud REVA public link can expose all user files

CVE-2026-23989 · published 9 months ago
Summary

The REVA component of OpenCloud allows a specially crafted request to skip the permission check on public links. An attacker could use this to create a zip or tar archive that contains every file the link creator is allowed to see. Upgrade to version 2.42.3 or later (or 2.40.3 or later) to close the gap.

What to do
  • Update github.com opencloud-eu to version 2.40.3.
  • Update github.com opencloud-eu to version 2.42.3.
Affected software
Ecosystem VendorProductAffected versions
go github.com opencloud-eu <= 2.40.1
>= 2.41.0, < 2.42.3
Fix: upgrade to 2.40.3
– heinlein opencloud_reva < 2.40.3
>= 2.41.0, < 2.42.3
cpe:2.3:a:heinlein:opencloud_reva:*:*:*:*:*:*:*:*
Original advisory text
REVA Public Link Exploit
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
CWE-22Path Traversal
Timeline
Published6 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-23989 · NVD
GHSA-9j2f-3rj3-wgpg · GHSA
CVE-2026-23989 · OSV
Track software like this
Free during beta