CVE-2026-115624: Medium severity GROWI GROWI vulnerability
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
Users with read-only permission, including guest users, may modify page drafts. The issue also affects users in pending, suspended, or invited status.
What access or interaction does an attacker need?
The vulnerability is network-accessible, requires no privileges, and requires no user interaction according to the provided CVSS vector. The affected functionality is collaborative editing.
What is the known impact?
An attacker may modify page drafts despite not being authorized to edit them. The provided severity vector indicates an integrity impact, with no stated confidentiality or availability impact.