CVE-2026-108730: Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs

Q: Who can exploit this issue?

An authenticated Raven user who is not a member of the target workspace can exploit it. The attacker also needs predictable channel IDs for channels in other workspaces.

Q: What information can be exposed?

The affected legacy message API can expose Public channel history. The legacy file API can expose file metadata for Open or Public channels across workspaces.

Q: Which API methods are affected?

The affected legacy methods are get_messages_with_dates and get_all_files_shared_in_channel. They skip the workspace membership check.

Q: Are private channels identified as affected?

No. The available information identifies Public channel history and Open/Public channel file metadata as exposed.

Published Oct 11, 2026

Updated

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/ravenmessage.py that skip the workspace membership check. Authenticated non-members can call getmessageswithdates or getallfilessharedinchannel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.

Affected Software

1 affected component

Raven Raven>=2.0.0<=3.0.0

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Raven user who is not a member of the target workspace can exploit it. The attacker also needs predictable channel IDs for channels in other workspaces.

What information can be exposed?

The affected legacy message API can expose Public channel history. The legacy file API can expose file metadata for Open or Public channels across workspaces.

Which API methods are affected?

The affected legacy methods are get_messages_with_dates and get_all_files_shared_in_channel. They skip the workspace membership check.

Are private channels identified as affected?

No. The available information identifies Public channel history and Open/Public channel file metadata as exposed.

CVE-2026-108730: Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which API methods are affected?

Are private channels identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which API methods are affected?

Are private channels identified as affected?