GROWI vulnerabilities
CVEs whose affected-version data names the GROWI package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-109848Medium· 4.2GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the c…
CVE-2026-105272Medium· 4.2GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and c…
CVE-2026-115624Medium· 5.3GROWI contains a missing authorization check vulnerability in its collaborative editing feature
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited stat…
CVE-2026-100727Medium· 5.3An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".