CVE-2026-108731: Missing Authorization in The-Commit-Company raven

CVE-2026-108731 describes a missing authorization vulnerability in The-Commit-Company's Raven product versions 2.0.0 through 3.0.0. Authenticated users assigned the Raven User role can exploit this flaw by invoking the join_workspace method to join invite-only Public workspaces despite the can_only_join_via_invite restriction. This unauthorized access grants them persistent membership, allowing reading and posting privileges in Public and Open channels within those workspaces.

The vulnerability allows authenticated users to bypass intended access controls, enabling unauthorized joining of invite-only Public workspaces. This could lead to unauthorized data exposure and unauthorized participation in workspace communications. However, the impact is limited to users who already have authenticated Raven User roles and does not allow privilege escalation beyond that role.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Raven User role assignments to trusted users only and monitor workspace membership changes closely.