Access Control Flaw in GROWI Affects Attachment Retrieval by Authenticated Users

CVE-2026-84204

What is CVE-2026-84204?

An access control vulnerability exists in GROWI's API endpoint for retrieving attachments. This flaw permits authenticated attackers to obtain metadata of attachments associated with pages they do not have permission to view, by manipulating known attachment identifiers. The issue arises from inadequate validation of user permissions, emphasizing the need for robust access controls within the application. This lack of authorization can lead to unauthorized access to sensitive information, highlighting the importance of addressing this vulnerability promptly.

References