Skip to content
Fencer Vulns
high 8.2

CVE-2026-23989 json

REVA Public Link Exploit

published 2026-02-05 9 mo ago modified 2026-06-17 4 mo ago also GHSA-9j2f-3rj3-wgpg , GO-2026-4444 , EUVD-2026-5629

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 22%
public exploits
0
none known

Summary

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.

Patch / fix

  • go github.com/opencloud-eu/reva/v2 2.40.3, 2.42.3
  • heinlein opencloud_reva 2.40.3, 2.42.3
  • govulncheck-vulndb openSUSE Leap 15.6 0.0.20260226T182644-150000.1.149.1

suse advisories SUSE-SU-2026:0757-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • opencloud-server openSUSE Tumbleweed 5.0.2-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2026:10159-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
9 mo ago

Exploit prediction

0.30% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub 3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Affected packages

ecosystem package affected fixed in
go github.com/opencloud-eu/reva/v2
<2.40.3
>=2.41.0, <2.42.3
2.40.3
2.42.3
go github.com/opencloud-eu/reva
all versions
 no fix listed

Affected products

  • opencloud-eu reva

Classification

Weakness
  • CWE-863 Incorrect Authorization
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.