CVE-2026-57500: REVA: Access to internal metadata
REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REVAto a version that resolves this vulnerability.Fixed in 2.40.5 - Upgrade
Upgrade
REVAto a version that resolves this vulnerability.Fixed in 2.46.4
Event History
Frequently Asked Questions
Who is exposed to this issue?
Authenticated users of affected REVA deployments can access internal metadata folders within their spaces. The issue affects versions earlier than 2.40.5 and 2.46.4.
What level of access does an attacker need?
An attacker needs an authenticated account. No user interaction is required, and the vulnerability can be exploited over the network.
How can this be remediated?
Upgrade REVA to version 2.40.5 or 2.46.4, which include the patch for this issue.