GROWI CVE-2026-84204

Exploitation requires a valid authenticated GROWI user account at any privilege level (PR:L per CVSS vector). The attacker must supply attachment ObjectIDs that correspond to restricted pages; these may be obtained through enumeration of the MongoDB ObjectID space, observation from accessible pages sharing the same time range, or application-level information leakage. The vulnerability is present on any GROWI deployment through v8.0.2 with the default v3 API enabled - no non-default configuration is required to be vulnerable. Exploitation is limited to attachment metadata retrieval (filename, MIME type, creator, page association); actual file content download requires a separate authorized fetch and is not bypassed by this endpoint alone. Deployments that have disabled the v3 API or restricted API access entirely via network controls are not exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately characterizes a network-reachable, low-complexity flaw that requires only a valid authenticated session and causes high confidentiality impact on the vulnerable system. The primary exposure is in multi-tenant or multi-role GROWI deployments - such as a corporate intranet wiki where sensitive project documents are attached to owner-restricted pages - where the trust boundary between user tiers is meaningful. EPSS data is absent from the provided intelligence, preventing a probability-based exploitation estimate; KEV status is negative and no public exploit code is known, so widespread exploitation is not yet evidenced. The realistic threat actor is an authenticated insider or compromised low-privilege account; an external unauthenticated attacker would first need to compromise credentials, limiting opportunistic mass exploitation. The confidentiality impact is bounded to attachment metadata (filename, format, creator) and does not directly expose file content, which moderates the practical impact somewhat - though original filenames alone can leak sensitive business context.

An attacker with a valid low-privilege GROWI account iterates over MongoDB ObjectIDs - either by brute force or by harvesting IDs from pages they do have access to - and issues GET requests to /_api/v3/attachment/:id for each candidate. For attachment IDs belonging to owner-restricted pages, the endpoint returns full metadata including the original filename (e.g., CONFIDENTIAL-Q4-BUDGET.xlsx), file format, and creator identity, all without any page-permission gate. No public exploit code has been identified, but the attack requires only standard HTTP requests and a session token.