CVE-2026-84204: GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval
GROWI contains an access control vulnerability in the GET /api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to send requests to the GROWI attachment API. They also need a known attachment identifier for an attachment associated with a page they are not allowed to view.
What information can be exposed?
The vulnerable endpoint can disclose attachment metadata from pages the authenticated user cannot access. The provided information does not state that attachment file contents can be retrieved.
How can we determine whether we are affected?
GROWI versions through 8.0.2 are identified as affected. Test whether a low-privileged authenticated account can request GET /_api/v3/attachment/:id for a known attachment on a page that account cannot view and receive metadata.