CVE-2026-53620: Medium severity GROWI vulnerability
Published Aug 31, 2026
·Updated
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.
Affected Software
1 affected component
GROWI
Event History
Aug 31, 2026
CVE Published
via MITRE·06:31 AM
Data Sourced
via MITRE·06:31 AM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated to GROWI. No user interaction is required, and the vulnerability is reachable over the network.
2
What data or actions are exposed if the issue is exploited?
An authenticated attacker may retrieve, modify, or delete another user's bookmark data through the bookmark folder APIs.