CVE-2026-84204 in GROWI
Summary
by MITRE • 09/01/2026
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/01/2026
The identified vulnerability represents a critical failure in server-side access control mechanisms within the GROWI collaborative wiki platform, specifically affecting the GET /_api/v3/attachment/:id endpoint. This flaw stems from an improper implementation of authorization checks where the application logic retrieves and returns metadata for attachments based solely on the provided identifier without verifying whether the requesting authenticated user possesses the necessary permissions to access the parent page associated with that attachment. In a properly secured system, any request to retrieve resources linked to protected content must trigger a validation step that confirms the user's role or group membership against the specific page-level security policies defined by administrators. The absence of this check allows for an unauthorized information disclosure scenario where sensitive data can be exfiltrated even when direct access to the source document is explicitly denied.
From a technical perspective, this vulnerability exploits the decoupling between resource identification and permission validation. Attackers who have valid authentication credentials but lack view permissions on specific pages can still interact with the API endpoint by supplying known or guessed attachment identifiers. The server processes these requests as legitimate because it validates the user's general login status rather than their specific access rights to the underlying content hierarchy. This behavior violates the principle of least privilege and fails to enforce object-level security controls, which are fundamental requirements for secure web applications handling sensitive organizational data.
The operational impact of this vulnerability is significant, particularly in environments where GROWI is used to store confidential documents, intellectual property, or regulated information. By leveraging this flaw, authenticated attackers can enumerate attachment metadata such as file names, sizes, creation dates, and potentially other descriptive fields that might reveal the nature of the content stored within those attachments. This reconnaissance activity facilitates further attacks by providing insight into what data is available on the server, even if the actual binary files are not directly downloadable through this specific vector. The exposure of metadata can lead to privacy violations, regulatory non-compliance with standards such as GDPR or HIPAA depending on the jurisdiction and content type, and a general erosion of trust in the platform's security posture.
This vulnerability aligns closely with CWE-284 Improper Access Control, specifically reflecting failures in authorization logic where access decisions are not properly enforced for specific objects. It also maps to MITRE ATT&CK technique T1005 Data from Local System Retrieval, as it involves the unauthorized collection of data stored on a system accessible by an authenticated user. The attack pattern resembles horizontal privilege escalation or lateral movement within the application's context, allowing users to bypass intended restrictions and access resources outside their authorized scope.
To mitigate this vulnerability, developers must implement strict authorization checks at the API level for every endpoint that serves protected content. This involves querying the database to verify if the authenticated user has view permissions on the specific page associated with the requested attachment ID before returning any metadata or file data. Additionally, implementing consistent access control libraries and conducting regular security code reviews can help prevent similar logic flaws in other parts of the application. Organizations should also consider deploying Web Application Firewalls that monitor for anomalous patterns of API usage indicative of enumeration attacks, although this serves as a compensating control rather than a primary fix. Regular penetration testing focused on authorization bypasses is recommended to ensure ongoing compliance with security best practices and to identify any new gaps in access enforcement logic.