GROWI CVE-2026-53620

The attacker must hold a valid authenticated session on the target GROWI instance (PR:L per CVSS vector); anonymous or unauthenticated access is insufficient. No additional elevated privileges, admin roles, or special feature enablement are required beyond a standard user account. Exploitation is limited to the bookmark folder API surface - other GROWI data (wiki pages, comments, user accounts) is not directly affected by this flaw. The attack is constrained to the GROWI instance perimeter: an intranet-only deployment requires network access to the internal segment first, while an internet-exposed instance reduces that barrier to registration or credential acquisition.

The overall risk is moderate. The CVSS 6.3 Medium score reflects limited scope (S:U) and low individual impacts across confidentiality, integrity, and availability (C:L/I:L/A:L), which accurately captures the blast radius: bookmark data is user-specific metadata, not core wiki content or credentials. The PR:L requirement meaningfully limits the attack surface to authenticated users of the same GROWI instance - an internet-exposed GROWI deployment reduces this barrier, while an intranet-only deployment raises it. No EPSS score was provided in the input data, and the absence of both KEV listing and known public exploit code further constrains realistic risk at this time. The IDOR pattern, however, is one of the most frequently weaponized vulnerability classes due to its low technical bar - any authenticated user who identifies the pattern can immediately exploit it without tooling. Organizations running multi-tenant or multi-user GROWI instances where bookmark privacy matters should treat remediation as a near-term priority, and even a mid-sized IT team managing shared GROWI deployments should treat this as urgent given how effortlessly IDOR can be exploited once discovered.

An authenticated GROWI user logs in with a standard account, then calls the bookmark folder API endpoints while substituting another user's folder ID - obtained through enumeration, observation of shared links, or integer-incrementing - in the request parameters. The server returns or modifies the target user's bookmark data without verifying ownership, allowing the attacker to silently read, overwrite, or delete bookmarks across any account on the instance. No public proof-of-concept code is identified at time of analysis, but the attack requires no special tooling beyond a browser or HTTP client.