CVE-2026-115624 in GROWI
Summary
by MITRE • 10/28/2026
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified vulnerability represents a critical failure in access control mechanisms within the GROWI collaborative document management platform. Specifically, it involves a missing authorization check that allows unauthorized users to execute write operations on page drafts despite possessing only read-only permissions or having no active account status at all. This flaw undermines the fundamental security principle of least privilege and demonstrates a significant gap in how the application validates user rights before processing state-changing requests related to document editing features.
From a technical perspective, this vulnerability is classified under CWE-285, which describes Improper Authorization. The root cause lies in the server-side logic handling draft modifications failing to adequately verify that the requesting entity holds sufficient privileges for write access. In typical web application architectures, endpoints responsible for updating resource states must perform rigorous checks against the user's session token or authentication credentials to ensure they match the required permission levels defined by the system's role-based access control model. Here, the validation step is either absent or incorrectly implemented, allowing any authenticated request targeting draft modification endpoints to succeed regardless of the associated user's actual permissions.
The operational impact of this flaw is substantial for organizations relying on GROWI for secure collaboration. Users with read-only access, such as external guests or auditors who should only view content without altering it, can inadvertently or maliciously modify drafts. Furthermore, users in pending, suspended, or invited states typically have restricted or no access to the system's core functionalities; however, this vulnerability grants them the ability to alter document versions before their accounts are fully activated or while they are temporarily disabled. This compromises data integrity and confidentiality, as sensitive information contained within draft pages can be altered by individuals who should not have visibility into such changes, potentially leading to misinformation, sabotage of ongoing projects, or exposure of confidential business logic embedded in the documents.
This behavior aligns with MITRE ATT&CK technique T1078, Valid Accounts, particularly when exploited by users with low-level privileges that are escalated through improper authorization checks. It also relates to CWE-639, Authorization Bypass Through User-Controlled Key, if the vulnerability allows manipulation of draft identifiers or user context parameters to bypass intended restrictions. The ability for suspended or pending users to modify content poses a unique risk as these accounts might be monitored less closely than active ones, providing an avenue for attackers to establish persistence or plant malicious content that becomes visible once the account is eventually activated.
To mitigate this vulnerability, immediate action must focus on reinforcing access control checks at every point where draft data is modified. Developers should implement strict server-side validation ensuring that any request attempting to update a page draft originates from a user with explicit write permissions for that specific resource. This involves verifying both the authentication status and the authorization level associated with the session token against the required role definitions before processing the modification logic. Additionally, implementing comprehensive logging of access attempts can aid in detecting exploitation patterns during incident response. Regular security audits focusing on privilege escalation vectors and integration testing of permission boundaries are essential to prevent similar flaws from persisting in collaborative software environments.