EUVD-2026-69291
GHSA-vphg-3vmw-2vv6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API requiring authenticated session (PR:L); missing authorization exposes only confidentiality of attachment metadata, with no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.
AnalysisAI
Missing authorization on the GET /_api/v3/attachment/:id endpoint in GROWI through v8.0.2 allows any authenticated user to retrieve attachment metadata - including original filenames and file formats - from pages they have no permission to view. The root cause (CWE-862) is an omitted page-viewer access check that the sibling /attachment/list endpoint already enforces, confirmed by VulnCheck and the upstream patch PR. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated GROWI user account at any privilege level (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately characterizes a network-reachable, low-complexity flaw that requires only a valid authenticated session and causes high confidentiality impact on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix introduced via commit d298e0b1dbbf568c99db657fa0f7e90f72ddc59b (https://github.com/growilabs/growi/commit/d298e0b1dbbf568c99db657fa0f7e90f72ddc59b) and PR #11810 (https://github.com/growilabs/growi/pull/11810), which adds page-level viewer access validation to the GET /_api/v3/attachment/:id handler consistent with the existing check on /attachment/list. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployed GROWI instances and confirm their versions, then inventory which pages contain sensitive attachments and audit current user role assignments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the inf
Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authen
Unauthenticated file disclosure in GROWI (all versions before 8.0.2) exposes private page attachments to any caller who
Remote denial of service via regular expression attack in GROWI allows unauthenticated network attackers to exhaust serv
Cross-user data exposure and tampering in GROWI v7.4.5 and earlier allows any authenticated user who learns a shared AI
Remote path traversal in GROWI v7.5.0 and earlier allows authenticated administrators to execute arbitrary EJS templates
Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to r
Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1
Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series)
GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vec
In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today