CVE-2026-109848: Medium severity WESEEK GROWI vulnerability
Published Oct 28, 2026
·Updated
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.
Affected Software
1 affected component
WESEEK GROWI
Event History
Oct 28, 2026
CVE Published
via MITRE·02:21 AM
Data Sourced
via MITRE·02:21 AM
DescriptionSeverity
Frequently Asked Questions
1
Who is exposed to exploitation?
An attacker must be able to log in to GROWI. The issue is not described as exploitable by an unauthenticated user.
2
What permissions does an attacker need beyond login access?
The attacker needs permission to edit at least one page where they can save copied content. They can obtain content from pages for which they do not have the required read permission.