CVE-2026-84205: GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval
GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have access to at least one page identifier. They can use that accessible page identifier in the query parameter while supplying a revision identifier belonging to a page they are not authorized to read.
What information could be exposed?
The issue exposes revision content from pages the authenticated attacker lacks permission to view. The provided data does not indicate integrity or availability impact.
Which endpoint should be reviewed for exposure?
Review access to GET /_api/v3/revisions/:id, particularly requests where the page identifier used for authorization does not correspond to the page associated with the revision identifier in the path.