Vulnerabilities

TI-2026-57900 CVE-2026-84205 · GHSA-gjwx-pwx3-4hxq

GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

LOW 31

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-01 No fix listed CWE-639

TI-2026-57899 CVE-2026-84204 · GHSA-vphg-3vmw-2vv6

GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

LOW 31

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-09-01 No fix listed CWE-862

Vulnerabilities

Filters

GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval