GROWI CVE-2026-115624

Requires that the attacker already have VIEW access to a target page and that GROWI's collaborative editing (Yjs) feature is in use. Three concrete exploitation paths per the advisory: (1) an unauthenticated guest when guest access is set to 'Readonly' on a publicly viewable page; (2) any logged-in read-only user on any page they can view, regardless of guest-access setting (including 'Deny'); (3) a logged-in non-active user (pending approval, suspended, or invited) with view access, also regardless of guest-access setting. Key LIMITERS: the attacker cannot directly save a revision (the page update API rejects them) - injected content only persists as a draft and reaches page history when a legitimate active user opens the editor and saves. Disabling user registration does NOT mitigate, since the attacker never registers or logs in. Setting guest access to 'Deny' blocks only unauthenticated guests, not logged-in read-only or non-active users; restricting page grants limits exposure.

This is a moderate, integrity-only authorization flaw (CWE-862) rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated access with no attack requirements, but the ONLY impact metric set is VI:L - low integrity, with confidentiality (VC:N) and availability (VA:N) explicitly unaffected and no scope/subsequent-system impact. The GHSA advisory confirms the mechanism: the Yjs collaborative-editing connection authorized clients by page-view permission instead of page-edit permission, so guests and read-only/non-active users can alter drafts. Crucially, the advisory notes the attacker CANNOT directly save a revision (the page update API rejects them); malicious content only persists as a draft and is committed to history only if a legitimate user later saves - a meaningful limiter that keeps real impact at 'low integrity,' consistent with the 6.9 score. No EPSS score, no CISA KEV listing, and no proof-of-concept exploit code were provided; the references are a vendor advisory (GHSA), a vendor news post, and a JVN entry, not working exploit code. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a real-but-non-urgent priority: patch in the normal monthly cycle. Signals are internally consistent - no conflicts between CVSS, description, and advisory - so this should be treated as a genuine integrity issue for exposed GROWI wikis, not a false high-CVSS alarm, but also not drop-everything urgent.

An attacker who can view a GROWI page (an unauthenticated guest on a page where guest access is 'Readonly', or a logged-in read-only/pending/suspended/invited user) connects to that page's collaborative editing (Yjs) session and injects content into the editing draft. The tampered draft is later committed to page history under a legitimate editor's name when that user opens the editor and saves, and changes are visible in real time to others editing the page. No public exploit code was identified at time of analysis; the available references are vendor and JVN advisories, not verified working exploits.