GROWI, Inc. has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 4.8 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.8
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-115624Medium· 5.3GROWI contains a missing authorization check vulnerability in its collaborative editing feature29CVE-2026-100727Medium· 5.3An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".29CVE-2026-109848Medium· 4.2GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key23CVE-2026-105272Medium· 4.2GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key23
GROWI, Inc. vulnerabilities
CVEs affecting GROWI, Inc., newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-109848Medium· 4.2GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the c…
CVE-2026-105272Medium· 4.2GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and c…
CVE-2026-115624Medium· 5.3GROWI contains a missing authorization check vulnerability in its collaborative editing feature
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited stat…
CVE-2026-100727Medium· 5.3An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".
An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".