EUVD-2026-69292
GHSA-gjwx-pwx3-4hxq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API, low complexity; requires authenticated session (PR:L); confidentiality-only impact, no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
AnalysisAI
Authenticated IDOR in GROWI through v8.0.2 exposes revision content from access-restricted pages via the GET /_api/v3/revisions/:id API endpoint. The endpoint performs its access check against a caller-supplied query parameter (page identifier) but returns the revision record identified by the URL path parameter without verifying both identifiers resolve to the same page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active authenticated session on the GROWI instance - any account with login access suffices, including low-privilege contributor or viewer roles (CVSS PR:L confirms this). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N places this as a straightforward network-reachable, low-complexity exploit requiring only a valid authenticated session - no special privileges or user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix is available via GitHub PR #11810 and commit d298e0b1dbbf568c99db657fa0f7e90f72ddc59b (https://github.com/growilabs/growi/pull/11810). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all GROWI deployments and confirm which run versions 8.0.2 or earlier. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the inf
Cross-site request forgery (CSRF) vulnerability in GROWI v3.4.6 and earlier allows remote attackers to hijack the authen
Unauthenticated file disclosure in GROWI (all versions before 8.0.2) exposes private page attachments to any caller who
Remote denial of service via regular expression attack in GROWI allows unauthenticated network attackers to exhaust serv
Cross-user data exposure and tampering in GROWI v7.4.5 and earlier allows any authenticated user who learns a shared AI
Remote path traversal in GROWI v7.5.0 and earlier allows authenticated administrators to execute arbitrary EJS templates
Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to r
Directory traversal vulnerability in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1
Improper input validation in GROWI versions prior to v4.2.3 (v4.2 Series), GROWI versions prior to v4.1.12 (v4.1 Series)
GROWI v4.1.3 and earlier allow remote attackers to obtain information which is not allowed to access via unspecified vec
In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today