CVE-2026-108730 — Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated …
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7