Access Control Flaw in GROWI Affects Unauthenticated Users
CVE-2026-100727

6.9MEDIUM

Key Information:

Vendor

Growi, Inc.

Status
Growi
Vendor
CVE Published:
5 October 2026

What is CVE-2026-100727?

An improper access control vulnerability in GROWI allows an unauthenticated attacker to gain unauthorized access to files within non-public pages. This occurs when the file upload setting is set to 'Local', potentially exposing sensitive information. Users are advised to review their settings and implement necessary security measures to prevent unauthorized access.

Affected Version(s)

GROWI 0

References

https://growi.co.jp/news/47
https://jvn.jp/en/jp/JVN24352487/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.