Read the docs
TI-2026-67628 Aliases CVE-2026-100727GHSA-h2pc-3fh7-hv26

Improper access control in GROWI exposes files on non-public pages

Priority LOW 36CWE-552Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-552.

Summary

GROWI, from version 0 before v7.5.5, has an improper access control flaw that exposes files stored in non-public pages. When the file upload setting is set to Local, an unauthenticated remote attacker can read those files, classified under CWE-552 (Files or Directories Accessible to External Parties).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00233 14th percentileScored 2026-11-07
Fix Fixed GROWI (GROWI, Inc.): v7.5.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GROWI, Inc.GROWIbefore v7.5.5v7.5.5Patch availableCNA
  • GROWI VendorGROWI, Inc. Affected before v7.5.5 Fixed in v7.5.5 Patch available CNA

Remediation

Upgrade GROWI to v7.5.5 or later, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA GROWI (GROWI, Inc.) Fixed in v7.5.5

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-100727
  2. 2026-10-05 Alias added: GHSA-h2pc-3fh7-hv26

References

Other 2

  • TI-2026-55432 GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests CVSS 4.0HIGH 8.7
  • TI-2026-29679 Regular expression denial of service in GROWI, Inc. GROWI CVSS 4.0HIGH 8.7
  • TI-2026-30347 Path traversal in GROWI, Inc. GROWI CVSS 4.0HIGH 8.6
  • TI-2026-20258 Missing authorization in GROWI, Inc. GROWI CVSS 4.0HIGH 8.7
  • TI-2026-81649 GROWI missing authorization check in collaborative editing CVSS 4.0MEDIUM 6.9
  • TI-2026-48471 Incorrect authorization in GROWI, Inc. GROWI CVSS 4.0MEDIUM 6.9
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences