diff --git a/changelog/unreleased/bump-reva.md b/changelog/unreleased/bump-reva.md
index eed0c160f..b55e58294 100644
--- a/changelog/unreleased/bump-reva.md
+++ b/changelog/unreleased/bump-reva.md
@@ -3,3 +3,4 @@ Enhancement: Bump reva
 bumps reva version
 
 https://github.com/owncloud/ocis/pull/6899
+https://github.com/owncloud/ocis/pull/6919
diff --git a/go.mod b/go.mod
index 63f45e551..387ed5659 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/coreos/go-oidc v2.2.1+incompatible
 	github.com/coreos/go-oidc/v3 v3.6.0
 	github.com/cs3org/go-cs3apis v0.0.0-20230516150832-730ac860c71d
-	github.com/cs3org/reva/v2 v2.15.1-0.20230731061316-db79e9b61738
+	github.com/cs3org/reva/v2 v2.15.1-0.20230731062052-2c2e370980e0
 	github.com/disintegration/imaging v1.6.2
 	github.com/dutchcoders/go-clamd v0.0.0-20170520113014-b970184f4d9e
 	github.com/egirna/icap-client v0.1.1
diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
index 574cc6f66..3e398ff50 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/public.go
@@ -161,9 +161,9 @@ func (h *Handler) createPublicLinkShare(w http.ResponseWriter, r *http.Request,
 	}
 
 	if !sufficientPermissions(statInfo.PermissionSet, permissions, true) {
-		response.WriteOCSError(w, r, http.StatusNotFound, "no share permission", nil)
+		response.WriteOCSError(w, r, http.StatusForbidden, "no share permission", nil)
 		return nil, &ocsError{
-			Code:    http.StatusNotFound,
+			Code:    http.StatusForbidden,
 			Message: "Cannot set the requested share permissions",
 			Error:   errors.New("cannot set the requested share permissions"),
 		}
@@ -417,7 +417,7 @@ func (h *Handler) updatePublicShare(w http.ResponseWriter, r *http.Request, shar
 
 	// empty permissions mean internal link here - NOT denial. Hence we need an extra check
 	if !sufficientPermissions(statRes.Info.PermissionSet, newPermissions, true) {
-		response.WriteOCSError(w, r, http.StatusNotFound, "no share permission", nil)
+		response.WriteOCSError(w, r, http.StatusForbidden, "no share permission", nil)
 		return
 	}
 
diff --git a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
index b272c569c..afe888047 100644
--- a/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
+++ b/vendor/github.com/cs3org/reva/v2/internal/http/services/owncloud/ocs/handlers/apps/sharing/shares/shares.go
@@ -232,7 +232,7 @@ func (h *Handler) CreateShare(w http.ResponseWriter, r *http.Request) {
 		case rpc.Code_CODE_NOT_FOUND:
 			response.WriteOCSData(w, r, response.MetaPathNotFound, nil, nil)
 		case rpc.Code_CODE_PERMISSION_DENIED:
-			response.WriteOCSError(w, r, http.StatusNotFound, "No share permission", nil)
+			response.WriteOCSError(w, r, http.StatusForbidden, "No share permission", nil)
 		default:
 			sublog.Error().Interface("status", statRes.Status).Msg("CreateShare: stat failed")
 			w.WriteHeader(http.StatusInternalServerError)
@@ -250,7 +250,7 @@ func (h *Handler) CreateShare(w http.ResponseWriter, r *http.Request) {
 
 	// check user has share permissions
 	if !conversions.RoleFromResourcePermissions(statRes.Info.PermissionSet, false).OCSPermissions().Contain(conversions.PermissionShare) {
-		response.WriteOCSError(w, r, http.StatusNotFound, "No share permission", nil)
+		response.WriteOCSError(w, r, http.StatusForbidden, "No share permission", nil)
 		return
 	}
 
@@ -298,7 +298,7 @@ func (h *Handler) CreateShare(w http.ResponseWriter, r *http.Request) {
 		// public links default to read only
 		_, _, ocsErr := h.extractPermissions(reqRole, reqPermissions, statRes.Info, conversions.NewViewerRole(h.resharing))
 		if ocsErr != nil && ocsErr.Error != conversions.ErrZeroPermission {
-			response.WriteOCSError(w, r, http.StatusNotFound, "No share permission", nil)
+			response.WriteOCSError(w, r, http.StatusForbidden, "No share permission", nil)
 			return
 		}
 		share, ocsErr := h.createPublicLinkShare(w, r, statRes.Info)
@@ -459,7 +459,7 @@ func (h *Handler) extractPermissions(reqRole string, reqPermissions string, ri *
 
 	if !sufficientPermissions(ri.PermissionSet, role.CS3ResourcePermissions(), false) && role.Name != conversions.RoleDenied {
 		return nil, nil, &ocsError{
-			Code:    http.StatusNotFound,
+			Code:    http.StatusForbidden,
 			Message: "Cannot set the requested share permissions",
 			Error:   errors.New("cannot set the requested share permissions"),
 		}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 78976024f..0fba14b4c 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -352,7 +352,7 @@ github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1
 github.com/cs3org/go-cs3apis/cs3/storage/registry/v1beta1
 github.com/cs3org/go-cs3apis/cs3/tx/v1beta1
 github.com/cs3org/go-cs3apis/cs3/types/v1beta1
-# github.com/cs3org/reva/v2 v2.15.1-0.20230731061316-db79e9b61738
+# github.com/cs3org/reva/v2 v2.15.1-0.20230731062052-2c2e370980e0
 ## explicit; go 1.20
 github.com/cs3org/reva/v2/cmd/revad/internal/grace
 github.com/cs3org/reva/v2/cmd/revad/runtime