A fault in the GRPC authorization middleware of the Reva component lets a malicious user skip the scope check that protects public links. By targeting the archiver service, an attacker can generate a zip or tar file that contains every file and resource the public link creator can access. This grants the attacker unrestricted read access to the link owner's data, allowing wide‑scale data exfiltration and exposure of confidential material.

The flaw affects the Reva interoperability platform from OpenCloud EU. Any deployment of Reva versions older than 2.42.3 or 2.40.3 that exposes public link functionality is vulnerable.

The CVSS score of 8.2 signals a high severity, while the EPSS score of less than 1% indicates a very low current likelihood of exploitation. The vulnerability is not reported in the CISA KEV catalog, suggesting no known active exploitation. Exploit requires only an attacker to supply a valid public link ID to the archiver service; no elevated privileges are needed. Once triggered, the attacker can repeatedly request archives to harvest all data linked to the public link creator.