CVE-2026-57500

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57500
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57500.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57500
Aliases
  • GHSA-3v8c-738m-4gcj
Published
2026-11-11T18:16:09Z
Modified
2026-11-12T02:48:31Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
REVA: Access to internal metadata
Details

REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57500.json"
}
References

Affected packages

Git / github.com/opencloud-eu/reva

Affected ranges

Type
GIT
Repo
https://github.com/opencloud-eu/reva
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
00c4b53a444737de011bf70a47dd2fd05e3343ed
Fixed
db96897373d011e84680d68e50c3a3ef30dc800a
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.40.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2.46.4"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        }
    ]
}

Affected versions

Other
public_avail
v0.*
v0.0.1
v0.1.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.16.0
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v2.*
v2.19.1
v2.23.0
v2.24.1
v2.26.6
v2.26.7
v2.26.8
v2.27.1
v2.27.2
v2.28.0
v2.29.0
v2.29.1
v2.30.0
v2.31.0
v2.32.0
v2.33.0
v2.33.1
v2.34.0
v2.35.0
v2.36.0
v2.37.0
v2.38.0
v2.39.0
v2.39.1
v2.39.2
v2.39.3
v2.40.0
v2.40.1
v2.40.2
v2.40.3
v2.40.4
v2.41.0
v2.42.0
v2.42.1
v2.42.2
v2.42.3
v2.42.4
v2.42.5
v2.42.6
v2.43.0
v2.44.0
v2.45.0
v2.46.0
v2.46.1
v2.46.2
v2.46.3
v2.5.0
v2.5.1
v2.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57500.json"