Threat database

Raven versions 2.0.0 through 3.0.0 have a missing authorization vulnerability that allows authenticated users with the Raven User role to bypass the can_only_join_via_invite setting. This enables them to join invite-only Public workspaces without an invitation, gaining persistent membership and the ability to read and post in Public and Open channels.

Raven versions 2.0.0 through 3.0.0 have a missing authorization vulnerability in legacy API methods that bypass workspace membership checks. This allows authenticated users who are not members of a workspace to access public channel history and file metadata by using predictable channel IDs. The vulnerability affects the methods get_messages_with_dates and get_all_files_shared_in_channel.