CVE-2026-68951 in GROWI
Summary
by MITRE • 08/31/2026
GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The identified vulnerability in GROWI represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw allows for unauthorized retrieval of sensitive user information by bypassing standard authentication protocols. In secure web applications, every request to access protected resources must be validated against the identity and permissions of the requesting entity. However, due to this implementation error, the application fails to properly verify whether an unauthenticated or improperly authenticated session possesses the necessary privileges to view specific data sets associated with other users.
Technically, the vulnerability likely stems from a logic flaw in how GROWI handles requests for bookmark-related endpoints. When a user attempts to access their own bookmarks, the system correctly validates ownership by checking the session token against the database records. In contrast, when an attacker crafts a request targeting another user's bookmark data—perhaps by manipulating identifiers such as user IDs or resource keys—the server does not adequately enforce that the requester is the legitimate owner of that data. This oversight enables direct object reference exploitation where the application trusts client-supplied input without sufficient backend validation to ensure access rights are appropriate for the specific action being performed.
The operational impact of this vulnerability is significant, particularly regarding user privacy and data integrity. Bookmarks often contain URLs to internal corporate resources, sensitive project documentation, or personal research materials that users expect to remain private. An unauthenticated attacker can exploit this flaw to scrape large volumes of bookmarked links from multiple accounts if the application does not implement rate limiting or additional security controls alongside authorization checks. This exposure facilitates further reconnaissance activities, allowing attackers to map out internal network structures, identify vulnerable services based on accessed URLs, and potentially launch targeted phishing campaigns using contextually relevant information gathered from these bookmarks.
To mitigate this risk, immediate remediation should focus on enforcing strict object-level access control checks within the application logic. Developers must ensure that every request for user-specific data verifies both the authentication status of the session and the authorization rights relative to the specific resource being accessed. Implementing consistent validation patterns where the system explicitly confirms that the authenticated user ID matches the owner ID of the requested bookmark is essential. Additionally, adopting a principle of least privilege ensures that default permissions deny access unless explicitly granted. Regular security audits and static code analysis focused on authentication and authorization flows can help identify similar gaps before they are exploited in production environments.