GHSA-3v8c-738m-4gcj: REVA: Access to internal metadata

Published Nov 11, 2026

Updated

REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Reva to a version that resolves this vulnerability.
Fixed in 2.40.5
Upgrade
Upgrade Reva to a version that resolves this vulnerability.
Fixed in 2.46.4

Event History

Nov 11, 2026

CVE Published

via OSV·06:16 PM

Data Sourced

via OSV·06:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user can access exposed internal metadata folders in their spaces. The provided vector indicates low privileges are required and no user interaction is needed.

Which versions contain the fix?

The issue is patched in REVA versions 2.40.5 and 2.46.4. Versions prior to those releases are affected according to the advisory.

GHSA-3v8c-738m-4gcj: REVA: Access to internal metadata

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which versions contain the fix?