Authorization Vulnerability in GROWI by Growi, Inc.
CVE-2026-68951

6.9MEDIUM

Key Information:

Vendor

Growi, Inc.

Status
Growi
Vendor
CVE Published:
31 August 2026

What is CVE-2026-68951?

GROWI is impacted by an improper authorization vulnerability that could allow unauthorized access to user-specific bookmark data. This flaw enables an unauthenticated attacker to exploit the system, potentially leading to data exposure and privacy concerns. It is crucial for users and administrators to apply the necessary security updates to mitigate this risk.

Affected Version(s)

GROWI 0

References

https://growi.co.jp/news/46/
https://jvn.jp/en/jp/JVN42348352/

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.