GROWI CVE-2026-105272

Requires an authenticated GROWI session - any logged-in user, including read-only accounts (no edit permission needed). The attacker must also know or find the target revision's ID, a MongoDB ObjectId composed of timestamp, per-process random value, and counter; it is not secret, and because a user can create their own revisions and learn the per-process value and counter, IDs generated around the same time by the same process are easier to find than a purely random value. Exploitation uses existing read endpoints - GET /_api/v3/page?pageId=<viewable>&revisionId=<foreign>, the /<viewable page>?revisionId=... view, or GET /_api/comments.get?page_id=<viewable>&revision_id=<foreign> - which checked access on the pageId but never verified the revision belonged to it. Limiting factors: authentication is mandatory, the correct revision ObjectId must be obtained, and share-link access is not affected.

This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor/CVSS 4.0 base vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N) yields a 2.3 score, and the vuln.today decision label is 'monitor' - both point to low urgency. Authentication is required: the vector contains PR:L, so this is an authenticated attacker, and the GHSA advisory confirms even a read-only logged-in user qualifies. Impact is limited (VC:L/VI:L): an attacker can read the body and comments of pages they lack read permission for, plus link comments to foreign revisions, but cannot write page content or affect availability. The AT:P (attack requirement present) reflects the real limiting factor - the attacker must know the target revision's MongoDB ObjectId, which the advisory notes is 'not secret by design' but also not trivially enumerable. No EPSS score was provided in the input, there is no CISA KEV listing, and no PoC/exploit reference is present among the sources (only the GHSA advisory, vendor news, and JVN entries). Bottom line: a real but low-severity authenticated information-disclosure flaw, not a widespread-exploitation emergency.

A logged-in GROWI user with read-only or limited access wants the contents of a page they are not permitted to view. Knowing (or inferring, from the semi-predictable ObjectId structure) the ID of a revision of that restricted page, they call GET /_api/v3/page with a pageId they can view and the foreign revisionId, and the server returns the other revision's body - leaving no trace. No public exploit identified at time of analysis; the attack requires authentication and knowledge of the target revision ID.