CVE-2026-109848 in GROWI
Summary
by MITRE • 10/28/2026
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw within GROWI represents a critical authorization bypass rooted in improper access control mechanisms during data modification operations. Specifically, the vulnerability exists within two distinct application programming interfaces: the tag update API and the page update API. These endpoints are designed to handle user-initiated changes to content metadata and body text respectively. The core technical deficiency lies in how these APIs process input parameters that serve as keys for database records or internal object references. Instead of strictly validating whether the authenticated user possesses the necessary permissions associated with the target resource, the system relies on a user-controlled key without sufficient server-side authorization checks. This architectural oversight allows an attacker to manipulate the request payload to reference resources they do not own and are not authorized to access.
From a technical perspective, this vulnerability is classified under CWE-284 Improper Access Control. The mechanism of exploitation involves crafting HTTP requests where the identifier for the target page or tag is substituted with that of another user's content. Because the application fails to verify ownership or read permissions before processing the update request, it proceeds to execute the operation as if the requester were the legitimate owner. This behavior indicates a failure in implementing robust object-level access controls, often referred to as Insecure Direct Object References when identifiers are directly exposed and manipulated by clients without adequate validation. The lack of strict boundary enforcement between user identity and resource ownership creates a significant security gap that can be systematically exploited.
The operational impact of this vulnerability is severe for both confidentiality and integrity aspects of the information system. An authenticated attacker, who may have minimal privileges such as standard viewer or editor status on their own pages, can leverage this flaw to read sensitive content from other users' pages without explicit read permissions. This constitutes a direct breach of data confidentiality. Furthermore, the ability to save changes to pages that the attacker is permitted to edit allows for further exploitation scenarios. By combining unauthorized reading with authorized writing capabilities, an attacker could potentially inject malicious scripts or misleading information into accessible areas while using their knowledge from restricted sections to tailor attacks against specific users or systems connected to GROWI. This dual capability amplifies the risk beyond simple data leakage, enabling potential phishing campaigns or integrity violations within collaborative environments.
In terms of threat modeling and industry frameworks, this vulnerability aligns with MITRE ATT&CK techniques related to Privilege Escalation and Collection via Local Network Share Access if applicable, but more accurately maps to T1078 Valid Accounts combined with lateral movement concepts where the attacker uses valid credentials to access unauthorized resources. The exploitation path typically involves initial authentication followed by manual or automated crafting of API requests targeting specific resource identifiers. This pattern is characteristic of attacks aimed at bypassing role-based access controls through parameter manipulation rather than exploiting software bugs in logic execution per se, highlighting a design-level deficiency in the security architecture.
To mitigate this vulnerability, immediate remediation efforts should focus on implementing strict server-side authorization checks for all API endpoints involved in data modification. Developers must ensure that every request to update tags or page content includes verification steps confirming that the authenticated user is the owner of the target resource or holds specific administrative privileges required for such actions. Implementing robust input validation and ensuring that object identifiers are not solely relied upon for access decisions are essential practices. Additionally, adopting a principle of least privilege ensures that users only have permissions necessary for their role, reducing the attack surface. Regular security audits focusing on API logic and automated testing using tools designed to detect authorization bypasses can help identify similar flaws in other parts of the application before they are exploited in production environments.