Skip to content
OpenAdvisories

Vendor

The-Commit-Company

3 known vulnerabilities.

Products

raven 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-108731

    Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass

    Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace met…

    The-Commit-Company raven
  • Medium 4.3
    CVE-2026-108730

    Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs

    Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel wi…

    The-Commit-Company raven