GHSA-m72c-xgjf-56ww: Low severity vulnerability

Published Oct 28, 2026

Updated

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.

Event History

Oct 28, 2026

CVE Published

via OSV·02:21 AM

Data Sourced

via OSV·02:21 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an existing account?

Yes. The attacker must be authenticated and have low-level privileges. The issue is remotely exploitable and does not require user interaction.

What is the expected impact on affected pages?

An attacker may obtain page contents and comments even when they do not have the required read permission. The supplied severity vector rates confidentiality and integrity impact as low, with no availability impact.

Are additional conditions required beyond network access and authentication?

Yes. The supplied severity vector indicates that attack requirements are present, although the available data does not specify what those requirements are.

GHSA-m72c-xgjf-56ww: Low severity vulnerability

Event History

Frequently Asked Questions

Does exploitation require an existing account?

What is the expected impact on affected pages?

Are additional conditions required beyond network access and authentication?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require an existing account?

What is the expected impact on affected pages?

Are additional conditions required beyond network access and authentication?