Description
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persistent members, reading and posting in Public and Open channels.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
The-Commit-Company raven
Default version status: unaffected
2.0.0 to ≤ 3.0.0affected
pkg:github/The-Commit-Company/ravenReferences
- https://hackmd.io/@haind03/frappe-raven-invite-only-workspace-flag-unenforced-20261010 ↗
- https://github.com/The-Commit-Company/raven/blob/a732e10f9c8b2ab3446038396e3eea763da617e7/raven/permissions.py#L74-L90 ↗
- https://github.com/The-Commit-Company/raven/blob/a732e10f9c8b2ab3446038396e3eea763da617e7/raven/api/workspaces.py#L58-L67 ↗
- https://github.com/The-Commit-Company/raven ↗
- https://www.vulncheck.com/advisories/raven-2.0.0-through-3.0.0-missing-authorization-via-join-workspace-invite-only-bypass ↗