Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: The-Commit-Company Clear all filters
TI-2026-70710 CVE-2026-108731 · GHSA-9xc3-m4r3-v8qc

Missing authorization in Raven lets users join invite-only workspaces

Priority LOW 23

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-11 No fix listed CWE-862
TI-2026-70709 CVE-2026-108730 · GHSA-vq7v-p77q-r9cp

Missing authorization in Raven exposes channel messages and files

Priority MEDIUM 57

Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00315 Published 2026-10-11 No fix listed CWE-862