CVE-2026-108731

12th percentile - higher than 12% of all known CVEs

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members, reading and posting in Public and Open channels.

An attacker can gain unauthorized access to workspaces and channels, leading to information leakage and the ability to post content on behalf of the organization. The risk also includes privilege escalation and access to confidential discussions.

Update Raven to a version later than 3.0.0 if available, and implement enforcement of the can_only_join_via_invite setting in the join_workspace method. Audit workspace membership and remove unauthorized users.