GrowChief EUVD-2026-101573

Requires (1) a GrowChief instance at or below version 0.3.0 operating in multi-tenant mode, and (2) the attacker holding any authenticated low-privilege account - feasible when self-registration is enabled, as the description states. The specific trigger is a GET request to /users/all-users with an empty or short search value, which reaches the getAllUsers handler that is missing the IsSuperAdmin guard. Limiting factors: the attacker must be able to register or otherwise obtain credentials (PR:L, not unauthenticated), and cross-tenant value only materializes on instances actually hosting multiple organizations; a single-tenant deployment yields no cross-tenant data.

This is a genuine but moderate-severity cross-tenant information disclosure, not a critical priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) is internally consistent with the description: network-reachable, low complexity, requires only a low-privilege authenticated account (PR:L), no user interaction, and limited confidentiality impact (VC:L) with no integrity or availability impact. The description's claim that attackers can self-register and that the IsSuperAdmin guard is simply absent strongly supports the low attack complexity and PR:L rating - the only barrier is obtaining any account. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public exploit is referenced, so automatability and real-world exploitation volume cannot be quantified from the available signals. The impact is bounded to enumeration of user ids, emails, names, and organization IDs (PII leakage useful for phishing/recon), not code execution or data modification, which is why both the vendor 4.0 score (5.3) and an independent 3.1 assessment (~4.3) land in the Medium band. Bottom line: a real, easily-triggered access-control flaw worth patching, but its low deployment footprint and limited impact keep it below high-urgency.

An attacker self-registers a standard low-privilege account on a multi-tenant GrowChief instance, then issues GET /users/all-users with an empty or short search value. Because the getAllUsers handler is missing its IsSuperAdmin guard, the response returns user ids, emails, names, and organization IDs for every tenant, which the attacker harvests for targeted phishing or account-mapping. No public exploit code is referenced in the available data, though the fixed code location and a public write-up are cited.