Authorization Bypass in GROWI Product by GROWI Labs
CVE-2026-109848

2.3LOW

Key Information:

Vendor

Growi, Inc.

Status
Growi
Vendor
CVE Published:
28 October 2026

What is CVE-2026-109848?

GROWI contains an authorization bypass vulnerability in its tag update API and page update API due to improper handling of user-generated keys. This flaw allows authenticated users to access restricted page contents without appropriate permission, potentially compromising sensitive information. Additionally, attackers may exploit this vulnerability to overwrite content in pages that they can edit, raising concerns about data integrity and security. Timely mitigation of this flaw is essential to protect user data and maintain system integrity.

Affected Version(s)

GROWI v4.5.5

References

https://github.com/growilabs/growi/security/advisories/GH...
https://growi.co.jp/news/48/
https://jvn.jp/en/jp/JVN51223238/

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.