CVE-2026-23989: REVA Public Link Exploit

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-06 · updated 2026-06-17
Weakness: CWE-863

Description

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.

Affected products

opencloud-eu reva: before 2.40.3; from 2.41.0 before 2.42.3 — fixed in 2.40.3, 2.42.3

How to fix

Upgrade to a fixed version: opencloud-eu reva 2.40.3, 2.42.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23989 or the next vulnerability affects your stack