VULNpocalypse
MediumVulnerabilityPatch available

GROWI: JVN discloses three authorization flaws up to v8.0.6, fixed in v8.0.7

JVN discloses three authorization flaws in GROWI up to v8.0.6 that let users read or alter pages they should not, so upgrade GROWI to v8.0.7.

Published
Fixed in
GROWI v8.0.7
Exploitation
No, the sources do not report any exploitation (not confirmed)

Live scores

CVE-2026-105272
EPSS
0.002
low predicted chance of attack
VEDAS
0.053
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-109848
EPSS
0.002
low predicted chance of attack
VEDAS
0.051
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

Live scores

CVE-2026-115624
EPSS
0.002
low predicted chance of attack
VEDAS
0.054
little exploit evidence
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

On 2026-10-27, JVN published JVN#51223238, which discloses three vulnerabilities in GROWI, a product of GROWI, Inc. (JVN). JVN says GROWI, Inc. reported the issues to JPCERT/CC so that users could be told about the fixes. JVN also says the developer has released GROWI v8.0.7 to address all three. On the same day, GROWI’s maintainers published matching GitHub security advisories. Each one is rated Moderate (GitHub: GHSA-m72c-xgjf-56ww, GitHub: GHSA-pqx5-gx68-83h4, GitHub: GHSA-3v2v-8q3r-mhm4).

According to JVN and the vendor advisories, the three issues are:

  • CVE-2026-105272 is an authorization bypass in the page view and comment feature (CWE-639). JVN gives it CVSS 4.0 base score 2.3 and CVSS 3.0 base score 4.2 (JVN).
    • The vendor says several read paths checked the caller’s access only to the page ID in the request. They never checked that the supplied revision ID belonged to that page.
    • As a result, a logged-in user could read another page’s revision body or comments by pairing that revision with a page they can view. Read-only users could do this too.
    • The vendor says reading this way “creates no revision and leaves no trace” (GitHub: GHSA-m72c-xgjf-56ww).
  • CVE-2026-109848 is an authorization bypass in the tag update API and the page update API (CWE-639). JVN gives it CVSS 4.0 base score 2.3 and CVSS 3.0 base score 4.2 (JVN).
    • The vendor says POST /_api/tags.update let a logged-in user who is not read-only do two things with a revision of a page they cannot view: read its body, and save that body as a new revision of a page they can access.
    • The vendor says PUT /_api/v3/page had a similar gap under specific conditions. The other revision’s body could then appear in a diff, including the diff sent in Slack update notifications (GitHub: GHSA-pqx5-gx68-83h4).
  • CVE-2026-115624 is missing authorization in the collaborative editing feature (CWE-862). JVN gives it CVSS 4.0 base score 6.9 and CVSS 3.0 base score 5.3 (JVN).
    • The vendor says the collaborative editing (Yjs) connection checked only view permission, not edit permission.
    • That let the following modify a page’s editing draft: unauthenticated guests on pages viewable without login, logged-in read-only users, and pending, suspended or invited users.
    • Injected content persists as the draft. If a legitimate user later saves, that content is committed under that user’s name (GitHub: GHSA-3v2v-8q3r-mhm4).

For the two revision ID issues, the vendor notes that the attacker must know the target revision ID. These IDs are MongoDB ObjectIds and “not secret by design” (GitHub: GHSA-m72c-xgjf-56ww).

Exploitation in the wild is not confirmed. None of the sources report it.

Am I affected?

JVN lists these affected versions (JVN):

  • CVE-2026-105272: GROWI v3.2.10 to v8.0.6
  • CVE-2026-109848: GROWI v4.5.5 to v8.0.6
  • CVE-2026-115624: GROWI v7.0.0 to v8.0.6

If you run any GROWI version from v3.2.10 up to and including v8.0.6, at least one of these issues applies.

The collaborative editing issue also reaches unauthenticated guests if guest access is set to “Readonly”. The vendor says disabling user registration does not mitigate it (GitHub: GHSA-3v2v-8q3r-mhm4).

What to do now

  1. Upgrade to GROWI v8.0.7 or later. JVN and all three vendor advisories name this version as the fix (JVN). The vendor lists no workaround for the two revision ID issues (GitHub: GHSA-pqx5-gx68-83h4).
  2. If you cannot upgrade yet, use the vendor’s interim workarounds for the collaborative editing issue (GitHub: GHSA-3v2v-8q3r-mhm4):
    • Set guest access to “Deny” in /admin/security. This only blocks unauthenticated guests.
    • Restrict the grant of pages that guests, read-only users and non-active users can view.
  3. Review editing drafts of publicly viewable pages before saving them. The vendor recommends this for administrators of affected sites (GitHub: GHSA-3v2v-8q3r-mhm4).

Sources