CVE-2026-110773: GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint
GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-registered low-privilege account can send an empty or short search value to GET /users/all-users to enumerate user ids, emails, names and organization IDs of every tenant.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated GrowChief user, including a self-registered low-privilege user, can exploit it. No administrative privileges are required.
What does an attacker need to send?
The attacker can request GET /users/all-users with an empty or short search value. This can enumerate user IDs, email addresses, names, and organization IDs across tenants.
Are organizations isolated from this exposure?
No. The affected handler can return user information from every organization because it lacks the IsSuperAdmin authorization guard.