https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T22:44:47.863873+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-23989 CVE-2026-23989 — REVA Public Link Exploit 2026-10-16T22:44:47.865449+00:00

Affected: opencloud-eu reva

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.