Raven 2.0.0 through 3.0.0 exposes a missing authorization flaw (CWE-862) in legacy message and file APIs located in raven/api/raven_message.py. The handler methods skip the normal workspace membership validation, meaning an authenticated user who is not a member of a target workspace can request historic channel messages or shared file metadata across that workspace. The vulnerability can be triggered by providing predictable channel IDs as parameters. The consequence is that non‑members may read public channel history and public file metadata that should have been restricted to authorized workspace members.

This issue affects all installations of Raven v2.0.0 through v3.0.0 released by The-Commit-Company. The components impacted are the legacy APIs used for retrieving messages by date and listing files shared in a channel. No specific sub‑versions are listed beyond the stated range, and no patched version is named in the advisory.

The CVSS base score is 5.3, indicating a moderate impact if successfully exploited. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need only an authenticated non‑member account, which may be obtained via legitimate or compromised credentials. Once authenticated, the attacker can repeatedly call the affected endpoints with observable channel identifiers, potentially harvesting sensitive public information from multiple workspaces. Because the flaw is only an authorization omission and the data exposed is public content, the risk is limited to confidentiality of public channel data rather than critical system compromise.