Insufficient Permission Check in GROWI Affects Attachment Retrieval for Unauthenticated Users

CVE-2026-80191

What is CVE-2026-80191?

GROWI contains a vulnerability that allows unauthenticated users to retrieve attachments without proper authorization. Specifically, the permission check for attachment requests is only performed for authenticated users. If an unauthenticated request is made with a valid attachment identifier, the system bypasses the check entirely, allowing unauthorized access to files. This flaw exists in routes such as /attachment/:id and /download/:id, making private attachments potentially accessible. It is crucial for users to upgrade to version 8.0.2, which addresses this issue by enforcing authorization checks for all types of requests.

References