CVE-2026-108730
Medium
Description
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.
SeverityMedium
CVSS4.3
Exploit probability—
ProductThe-commit-company Raven
PublishedOct 11, 2026
First seenOct 11, 2026
Weakness typeCWE-862Missing authorization
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| The-Commit-Company raven | 2.0.0 ≤ v ≤ 3.0.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.