Live › vulnerability › CVE-2026-109848
Go to dashboardGROWI's tag update API and page update API trust a user-controlled key, which bypasses the read permission check. A logged-in attacker can copy contents of pages they cannot read into pages they can edit.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Teams that self-host GROWI with user accounts and page permissions that restrict who can read some pages. Instances where every user can read every page are less exposed. The sources do not name affected or fixed versions.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.
This page as .md · .json · in your agent: get_signal("CVE-2026-109848")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.