High severityNVD Advisory· Published Feb 6, 2026· Updated Feb 6, 2026
REVA Public Link Exploit
CVE-2026-23989
Description
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/opencloud-eu/reva/v2Go | < 2.40.3 | 2.40.3 |
github.com/opencloud-eu/reva/v2Go | >= 2.41.0, < 2.42.3 | 2.42.3 |
Affected products
4- ghsa-coords3 versionspkg:golang/github.com/opencloud-eu/reva/v2pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/opencloud-server&distro=openSUSE%20Tumbleweed
< 2.40.3+ 2 more
- (no CPE)range: < 2.40.3
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- (no CPE)range: < 5.0.2-1.1
- Range: < 2.40.3
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-9j2f-3rj3-wgpgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-23989ghsaADVISORY
- github.com/opencloud-eu/reva/commit/95aa2bc5d980eaf6cc134d75782b4f5ac7b36ae1ghsax_refsource_MISCWEB
- github.com/opencloud-eu/reva/security/advisories/GHSA-9j2f-3rj3-wgpgghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.