CVE-2026-108730

15th percentile - higher than 15% of all known CVEs

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces.

An attacker can access message history and file metadata in channels they do not belong to, leading to information leakage and confidentiality breaches. The risk also includes using this information for further attacks.

Update Raven to a version later than 3.0.0 if available, and implement workspace membership checks in the get_messages_with_dates and get_all_files_shared_in_channel methods. Monitor access to these methods and restrict their availability to non-members.