A critical authorization bypass vulnerability in the OpenCloud Reva platform allows unauthenticated attackers to exfiltrate data by creating unauthorized archives of system resources.

This vulnerability involves an improper authorization flaw (CWE-863) within the GRPC middleware. An unauthenticated attacker can exploit the archiver service to bypass public link scope restrictions and create archives of files that the link creator has access to.

The ability for an unauthenticated user to aggregate and download unauthorized resources poses a significant risk to data confidentiality. Given the CVSS score of 8.2, this high-severity flaw could lead to extensive data exposure, regulatory non-compliance, and loss of intellectual property if exploited by malicious actors.

Immediate Action: Upgrade the OpenCloud Reva component to version 2.40.3 or 2.42.3 immediately to resolve the authorization middleware flaw.

Proactive Monitoring: Audit access logs for unusual activity or high volumes of archive creation requests originating from the archiver service.

Compensating Controls: Implement strict network perimeter controls and utilize a Web Application Firewall to monitor and block abnormal GRPC traffic patterns targeting the archiver service.

Public Exploit Available: No (exploit_available: unknown)

The severity of this authorization bypass requires immediate attention to protect sensitive data environments. Administrators should prioritize patching to the recommended versions to ensure the GRPC middleware correctly enforces scope verification, thereby neutralizing the risk of unauthorized resource archiving.