Raven
Monthly
Missing authorization in Frappe Raven 2.0.0 through 3.0.0 lets an authenticated user with the Raven User role join Public workspaces that are configured as invite-only, because the can_only_join_via_invite setting is not enforced by the join_workspace API. The practical consequence is unauthorized persistent membership in those workspaces, allowing the attacker to read and post messages in the associated Public and Open channels, but not to reach private data or administrative functions. Exploitation requires a valid authenticated account and a target that is specifically a Public workspace with invite-only enabled; no public exploit code has been identified at time of analysis, and EPSS/KEV signals are absent, so this rates as a medium-severity, low-to-moderate real-world risk.
Missing authorization checks in Raven (Frappe-based team chat) 2.0.0 through 3.0.0 allow any authenticated user to read Public channel message history and Open/Public channel file metadata from workspaces they do not belong to, by calling the legacy get_messages_with_dates and get_all_files_shared_in_channel methods with predictable or guessed channel IDs. The CVSS 4.0 vector (PR:L, VC:L) confirms this is an authenticated, read-only confidentiality exposure with no integrity or availability impact, and our independent assessment rates it a genuinely medium/low-priority issue rather than a high-severity one. No public exploit code was identified at time of analysis and no KEV listing applies.
Missing authorization in Frappe Raven 2.0.0 through 3.0.0 lets an authenticated user with the Raven User role join Public workspaces that are configured as invite-only, because the can_only_join_via_invite setting is not enforced by the join_workspace API. The practical consequence is unauthorized persistent membership in those workspaces, allowing the attacker to read and post messages in the associated Public and Open channels, but not to reach private data or administrative functions. Exploitation requires a valid authenticated account and a target that is specifically a Public workspace with invite-only enabled; no public exploit code has been identified at time of analysis, and EPSS/KEV signals are absent, so this rates as a medium-severity, low-to-moderate real-world risk.
Missing authorization checks in Raven (Frappe-based team chat) 2.0.0 through 3.0.0 allow any authenticated user to read Public channel message history and Open/Public channel file metadata from workspaces they do not belong to, by calling the legacy get_messages_with_dates and get_all_files_shared_in_channel methods with predictable or guessed channel IDs. The CVSS 4.0 vector (PR:L, VC:L) confirms this is an authenticated, read-only confidentiality exposure with no integrity or availability impact, and our independent assessment rates it a genuinely medium/low-priority issue rather than a high-severity one. No public exploit code was identified at time of analysis and no KEV listing applies.