8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23989

CVE-2026-23989: REVA Public Link Exploit

REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23989

CVE-2026-23989:

8.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/opencloud-eu/reva/v2	go	<= 2.40.1	2.40.3
github.com/opencloud-eu/reva/v2	go	>= 2.41.0, < 2.42.3	2.42.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the GRPC authorization middleware of OpenCloud Reva, specifically within the scope validation for public links. The analysis of the security patch 9bb19f69efc3c40a8b077af9961a340f14205ef5 reveals several vulnerable functions in the internal/grpc/interceptors/auth/scope.go file.

The root cause is insufficient validation when checking if a requested resource is within the scope of a public share. The primary vulnerable function was checkRelativeReference, which was completely removed by the patch. The commit message explicitly states this function contained a bug allowing access to resources outside the share's scope.

Another key vulnerable function was checkIfNestedResource. Its original implementation relied solely on path prefix matching to determine if a resource was a child of another. This is a classic path traversal flaw. The patch corrected this by first verifying that both the requested resource and the shared resource belong to the same storage space before checking the path hierarchy.

The function resolvePublicShare is the orchestrator in the vulnerable call chain, as it was responsible for calling the flawed checkRelativeReference function.

Finally, the getRefKey function, which was also removed, played a role in the caching mechanism. Its flawed logic for generating cache keys could have been exploited to bypass security checks.

An attacker could exploit this by crafting a request to the "archiver" service, using a public link token. The flawed validation would allow the archiver to access and package files that the creator of the public link has access to, but which are outside the intended scope of the public link itself. The identified functions would be present in the runtime profile during such an exploitation attempt.

Vulnerable functions

checkRelativeReference

internal/grpc/interceptors/auth/scope.go

This function was responsible for checking if a resource access was within the scope of a public share. It contained flawed logic that could be bypassed to access resources outside the intended scope. It was removed as part of the fix.

checkIfNestedResource

internal/grpc/interceptors/auth/scope.go

This function checked if a resource was a child of a shared resource. The original implementation only checked for path prefixes, which is susceptible to path traversal attacks. The patch added a crucial check to ensure both resources reside within the same storage space, preventing an attacker from accessing resources in other spaces.

resolvePublicShare

internal/grpc/interceptors/auth/scope.go

This function is part of the GRPC authorization interceptor and is responsible for handling authorization for public shares. It was modified to remove a call to the vulnerable `checkRelativeReference` function, indicating it was part of the exploitation path.

getRefKey

internal/grpc/interceptors/auth/scope.go

This function was used to generate a cache key from a resource reference. Its simplistic implementation could be manipulated by a crafted request to cause a cache collision, potentially leading to an authorization bypass. It was replaced by a more robust method of formatting the reference.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.