GROWI CVE-2026-68951

No special conditions are required for exploitation - the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote unauthenticated exploitation against any network-accessible GROWI instance in its default configuration. The attacker must be able to reach the GROWI HTTP(S) service and identify or enumerate a target user identifier. Exploitation is limited to reading bookmark data only - no write, delete, authentication escalation, or remote code execution capability is implied. GROWI instances deployed on internal networks not reachable from the attacker's position, or protected by a network-layer authentication proxy, would not be exploitable without first obtaining access to that network.

The CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N produces a Medium score of 5.3. Attack complexity is low, no privileges are required, and no user interaction is needed, making this trivially exploitable by any unauthenticated attacker with network access to the GROWI instance. However, impact is strictly limited to confidentiality of bookmark data (C:L), with no integrity or availability consequences. No EPSS probability was provided, and the absence of KEV listing and POC suggests this is not being actively exploited at scale. Real-world risk is primarily determined by the sensitivity of information stored in user bookmarks - in some deployments bookmarks may reveal internal page structure or sensitive resource paths, elevating the practical impact beyond what C:L implies. This is a genuine remediation priority for internet-exposed GROWI instances but lower urgency for air-gapped or intranet-only deployments.

An unauthenticated attacker sends crafted HTTP requests to GROWI's bookmark retrieval API, supplying target user identifiers (e.g., user IDs discoverable through other unauthenticated endpoints or enumeration). Because the server does not verify the requester's identity against the requested resource owner, it returns the victim's bookmark list. No public POC has been identified, but the low attack complexity means exploitation requires only basic HTTP tooling.