What is the CVSS score of CVE-2026-23989?

CVE-2026-23989 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Opencloud Reva are affected by CVE-2026-23989?

A critical authorization bypass vulnerability in REVA's public link sharing feature allows attackers to circumvent access controls, potentially exposing sensitive documents and collaboration data to…. A patch is available.

How to fix or mitigate CVE-2026-23989?

Within 24 hours: Inventory all REVA deployments and identify instances running versions 2.42.0-2.42.2 or 2.40.0-2.40.2. Within 7 days: Apply vendor patches to upgrade affected instances to version 2.42.3 or 2.40.3, prioritizing production environments. Within 30 days: Conduct a security audit of public link sharing activity logs to detect potential unauthorized access attempts and review permissions on shared resources.

Opencloud Reva CVE-2026-23989

HIGH

Incorrect Authorization (CWE-863)

2026-02-06 security-advisories@github.com

GHSA-9j2f-3rj3-wgpg

Authentication Bypass Opencloud Reva Suse

8.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 24, 2026 - 20:57 nvd

Patch available

CVE Published

Feb 06, 2026 - 19:16 nvd

HIGH 8.2

DescriptionGitHub Advisory

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.

AnalysisAI

Unauthenticated attackers can bypass public link scope verification in OpenCloud Reva versions prior to 2.42.3 and 2.40.3 through a flaw in GRPC authorization middleware. By exploiting the archiver service, an attacker can create archives containing all resources accessible to the public link creator, resulting in unauthorized information disclosure. A patch is available in versions 2.42.3 and 2.40.3.

Technical ContextAI

Classified as CWE-863 (Incorrect Authorization). Affects Opencloud Reva. REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.