Authorization Bypass in GROWI’s Page Viewing and Commenting Features
CVE-2026-105272

2.3LOW

Key Information:

Vendor

Growi, Inc.

Status
Growi
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105272?

GROWI contains a vulnerability that allows an authenticated attacker to bypass authorization restrictions in the platform’s page viewing and commenting functionalities. This issue arises from improper handling of a user-controlled key, enabling unauthorized access to the contents and comments of pages that require read permissions. As a result, sensitive information may be exposed without the necessary access rights, posing a significant risk to user privacy and data integrity.

Affected Version(s)

GROWI v3.2.10

References

https://github.com/growilabs/growi/security/advisories/GH...
https://growi.co.jp/news/48/
https://jvn.jp/en/jp/JVN51223238/

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.