CVE-2026-84205
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
Risk Assessment
Risk of unauthorized access to page content, potentially leading to disclosure of sensitive information and confidentiality breaches.
Recommendation
Upgrade GROWI to a patched version. Additionally, restrict API access and monitor logs for unusual requests.
Other vulnerabilities in GROWI
See all- CVE-2026-41951High
A path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS templates on the server when an email server is running in GROWI.
- CVE-2026-41040High
GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string.
- CVE-2026-84204Medium
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.
- CVE-2026-68951Medium
GROWI contains an incorrect authorization vulnerability. If exploited, an unauthenticated attacker could retrieve other users' bookmark data.
- CVE-2026-53620Medium
GROWI contains an authorization bypass vulnerability through user-controlled key in bookmark folder APIs. An authenticated attacker could retrieve, tamper with, and/or delete other users' bookmark data.
- CVE-2026-80191High
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam skips the check when the user is null, so a request without a session skips the check and returns the file. An unauthenticated attacker with an attachment identifier can download the file even if the page is private. Version 8.0.2 checks both authenticated and unauthenticated requests.
Original NVD description (English source)
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS