CVE-2026-53620 in GROWI
Summary
by MITRE • 08/31/2026
GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an authenticated attacker could retrieve, tamper with, and/or delete the other user's bookmark data.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The identified security flaw within GROWI represents a critical failure in access control mechanisms specifically affecting the bookmark folder application programming interfaces. This vulnerability stems from an authorization bypass that occurs when the system processes requests containing user-controlled keys for identifying resource ownership or scope. In secure software architecture, APIs must strictly validate that the authenticated user initiating a request possesses explicit permission to interact with the specific data entity being targeted. However, in this instance, the application relies on client-supplied identifiers without sufficiently verifying these against the session's authorized permissions or database records of actual ownership. This design oversight allows an attacker who has successfully authenticated to the platform to manipulate input parameters and effectively impersonate other users by specifying their unique resource keys as targets for API operations.
From a technical perspective, this flaw aligns with CWE-284 Improper Access Control, where the software does not properly restrict access to resources based on user roles or privileges. The exploitation vector is straightforward yet potent: an authenticated adversary can craft HTTP requests that target bookmark folders belonging to other users by substituting valid identifiers from those accounts into their own request payloads. Because the backend logic fails to cross-reference these keys with the identity of the currently logged-in session, it treats the maliciously crafted request as legitimate. This lack of server-side validation means that integrity checks are entirely dependent on client-side assertions or insufficient middleware rules, creating a direct path for unauthorized data manipulation.
The operational impact of this vulnerability is severe due to the sensitive nature of bookmark data within collaborative platforms like GROWI. An attacker can exploit this flaw to retrieve private bookmarks intended only for specific users, leading to Confidentiality violations akin to CWE-200 Information Exposure. Furthermore, the ability to tamper with or delete these entries results in significant Integrity compromises as defined by CWE-354 and CWE-602 respectively. This capability allows an adversary to disrupt workflow continuity, steal intellectual property embedded within linked resources, or cause denial of service for targeted users by removing their curated collections of important links. In enterprise environments where GROWI is used for knowledge management, such unauthorized access undermines trust in the platform's security posture and can lead to regulatory non-compliance if sensitive information is exposed.
To mitigate this risk, developers must implement strict server-side authorization checks that verify resource ownership against the authenticated user's identity before processing any API request involving bookmark folders. This involves ensuring that every operation retrieves or modifies data only after confirming a direct relationship between the session token and the target resource ID in the database. Additionally, implementing principle of least privilege ensures that users can only interact with resources explicitly assigned to them. Regular security audits focusing on access control logic and automated testing using tools designed to detect broken object level authorization flaws are essential for maintaining long-term resilience against such vulnerabilities aligned with MITRE ATT&CK techniques related to Collection and Exfiltration via Application Layer Protocol.