CVE-2026-23989
High · 8.2CVSS
8.2
EPSS
0.3%
Published
Feb 6, 2026
CISA due date
—
The record
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/opencloud-eu/reva | 0 | No fix |
| Go | github.com/opencloud-eu/reva/v2 | 0 | 2.40.3 |
| Go | github.com/opencloud-eu/reva/v2 | 2.41.0 | 2.42.3 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
| openSUSE:Tumbleweed | opencloud-server | 0 | 5.0.2-1.1 |
Related vulnerabilities
- GO-2026-4444 OpenCloud Reva has a Public Link Exploit in github.com/opencloud-eu/reva Same vulnerability
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-27018 Gotenberg is an API for converting document formats. Also affects govulncheck-vulndb