CVE-2026-23989 REVA Public Link Exploit
A malicious user can bypass public link scope verification to access all resources accessible to the link creator via the archiver service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23989?
CVE-2026-23989 is a high-severity missing authorization vulnerability in opencloud-eu reva, published on 6 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
Weakness: CWE-863
Which versions are affected by CVE-2026-23989?
6 open source packages ship an affected version, including github.com/opencloud-eu/reva/v2 and github.com/opencloud-eu/reva. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/opencloud-eu/reva/v2 Go | All versions | 2.40.3, 2.42.3 |
github.com/opencloud-eu/reva/v2 Go | All versions | 2.40.3 |
github.com/opencloud-eu/reva/v2 Go | All versions | 2.40.3 |
github.com/opencloud-eu/reva/v2 Go | From 2.41.0 | 2.42.3 |
github.com/opencloud-eu/reva/v2 Go | From 2.41.0 | 2.42.3 |
github.com/opencloud-eu/reva Go | All versions | None |
Linux distribution packages (1)
opencloud-server openSUSE:Tumbleweed | All versions | 5.0.2-1.1 |
Products include Heinlein Opencloud Reva.
How do I fix CVE-2026-23989?
Upgrade github.com/opencloud-eu/reva/v2 to a fixed version for your release line: 2.40.3 or 2.42.3.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-23989 being exploited?
There is no known exploitation of CVE-2026-23989 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-9j2f-3rj3-wgpg, GO-2026-4444, openSUSE-SU-2026:10159-1.