Description
REVA is an interoperability platform. Prior to 2.42.3 and 2.40.3, a bug in the GRPC authorization middleware of the "Reva" component of OpenCloud allows a malicious user to bypass the scope verification of a public link. By exploiting this via the the "archiver" service this can be leveraged to create an archive (zip or tar-file) containing all resources that this creator of the public link has access to. This vulnerability is fixed in 2.42.3 and 2.40.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| opencloud-eu | reva | < 2.40.3, >= 2.41.0, < 2.42.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | opencloud-server | 5.0.2-1.1 | openSUSE-SU-2026:10159-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260226T182644-150000.1.149.1 | SUSE-SU-2026:0757-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
dinosn/cve-2026-23989-opencloud-lab ★ 1 · Aug 29, 2026
Reproduction lab (A/B Docker) for CVE-2026-23989 — OpenCloud / ownCloud Infinite Scale public-link scope-validation bypass in Reva
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/opencloud-eu/reva | all versions | — | GO-2026-4444 |
| Go | github.com/opencloud-eu/reva/v2 | < 2.40.3 | 2.40.3 | GHSA-9j2f-3rj3-wgpg |
| Go | github.com/opencloud-eu/reva/v2 | >= 2.41.0, < 2.42.3 | 2.42.3 | GHSA-9j2f-3rj3-wgpg |
| Go | github.com/opencloud-eu/reva/v2 | < 2.40.3 · >= 2.41.0, < 2.42.3 | 2.40.3, 2.42.3 | GO-2026-4444 |
Advisories 3
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0757-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 4, 2026
- openSUSE-SU-2026:10159-1 opencloud-server-5.0.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 7, 2026