CVE-2026-108730 Details
Description
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.
A missing authorization vulnerability has been identified in Raven versions 2.0.0 through 3.0.0. This vulnerability exists in legacy methods within 'raven/api/raven_message.py', where the workspace membership check is bypassed. Authenticated users who are not workspace members can exploit this by calling 'get_messages_with_dates' or 'get_all_files_shared_in_channel' with predictable channel IDs. This allows them to access public channel history and open/public channel file metadata across different workspaces.
The vulnerability can be addressed by updating the 'check_permission' function to include workspace membership checks for public and open channels, and by routing the permission checks through the 'frappe.has_permission' method, which enforces the correct access controls.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe Raven | >= 2.0.0, <= 3.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |