CVE-2026-108730

Name of the Vulnerable Software and Affected Versions Raven versions 2.0.0 through 3.0.0

Description Missing authorization in legacy methods within raven/api/raven message.py allows authenticated non-members to bypass workspace membership checks. By using predictable channel IDs, an attacker can call the functions get messages with dates() and get all files shared in channel() to read Public channel history and Open/Public channel file metadata across different workspaces.

Recommendations Update Raven to a version later than 3.0.0. As a temporary mitigation, restrict access to the get messages with dates() and get all files shared in channel() functions in raven/api/raven message.py.