the-commit-company vulnerabilities

Products

• the-commit-company/raven 3

Latest the-commit-company CVEs

Newest publication first

1. CVE-2026-108731 Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.22%

   Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace method to become persist...

2. CVE-2026-108730 Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.32%

   Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channe...

3. CVE-2025-31132 Raven allows Remote Code Execution due to improper validation

   Published 2025-04-01

   High·CVSS 8.1 EPSS 0.64%

   Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.