Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M
CVE-2026-23989REVA Public Link Exploit
High 8.2
In plain English
A high-severity incorrect authorization in reva from opencloud-eu. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/opencloud-eu/reva | no fix listed | GO-2026-4444 |
| Go | github.com/opencloud-eu/reva/v2 | 2.40.3 | GHSA-9j2f-3rj3-wgpg |
| Go | github.com/opencloud-eu/reva/v2 | 2.42.3 | GHSA-9j2f-3rj3-wgpg |
| Go | github.com/opencloud-eu/reva/v2 | 2.40.3, 2.42.3 | GO-2026-4444 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| opencloud-eu | reva | < 2.40.3>= 2.41.0, < 2.42.3 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N