{"id":"CVE-2026-109848","kind":"vulnerability","aliases":["CVE-2026-109848"],"related":[],"title":"GROWI: tag and page update APIs let logged-in users read and write restricted pages","description":"GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.","summary":"GROWI's tag update API and page update API trust a user-controlled key, which bypasses the read permission check. A logged-in attacker can copy contents of pages they cannot read into pages they can edit.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["growi","package","self-hosted","wiki"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-28T03:17:09+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","triaged_at":"2026-10-28T03:32:51+00:00","updated_at":"2026-10-28T03:32:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"GROWI: tag and page update APIs let logged-in users read and write restricted pages","impact":"medium","summary":"GROWI's tag update API and page update API trust a user-controlled key, which bypasses the read permission check. A logged-in attacker can copy contents of pages they cannot read into pages they can edit.","category":"package","nicknames":[],"who_cares":["growi","self-hosted","wiki"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads restricted wiki pages and saves their contents to editable pages","analyst_note":"Find the affected and fixed GROWI versions and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-109848 or the GROWI project's release notes.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams that self-host GROWI with user accounts and page permissions that restrict who can read some pages. Instances where every user can read every page are less exposed. The sources do not name affected or fixed versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000543,"input_tokens":3311,"output_tokens":423,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109848':19A,22A '-2026':18A,21A 'api':6A,33B,37B,78C,83C 'attack':54B,99C,125C 'author':71C 'bypass':45B,72C 'cannot':61B 'check':49B 'contain':69C 'content':57B,110C 'control':42B,92C 'copi':56B 'cve':17A,20A 'due':84C 'edit':67B,127C 'exploit':95C 'growi':1A,23B,29B,68C 'host':27B 'improp':86C 'key':43B,93C 'let':7A 'log':9A,52B,102C 'logged-in':8A,51B 'may':107C 'obtain':108C 'packag':24B 'page':4A,16A,35B,59B,64B,81C,112C,122C 'permiss':48B,117C 'product':106C 'read':12A,47B,62B,116C 'requir':115C 'restrict':15A 'save':119C 'self':26B 'self-host':25B 'tag':2A,31B,76C 'trust':38B 'updat':5A,32B,36B,77C,82C 'use':87C 'user':11A,41B,91C 'user-control':40B,90C 'vulner':73C,97C 'wiki':28B 'without':113C 'write':14A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host GROWI with user accounts and page permissions that restrict who can read some pages. Instances where every user can read every page are less exposed. The sources do not name affected or fixed versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109848","severity":null,"published_at":"2026-10-28T03:17:09+00:00","modified_at":"2026-10-28T03:17:09+00:00","first_seen_at":"2026-10-28T03:31:01+00:00","fetched_at":"2026-10-28T03:31:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}