---
id: "CVE-2026-109848"
kind: "vulnerability"
aliases: ["CVE-2026-109848"]
title: "GROWI: tag and page update APIs let logged-in users read and write restricted pages"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["growi", "package", "self-hosted", "wiki"]
not_affected_if: ["auth-required"]
published_at: "2026-10-28T03:17:09+00:00"
first_seen_at: "2026-10-28T03:31:01+00:00"
updated_at: "2026-10-28T03:32:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109848", "first_seen_at": "2026-10-28T03:31:01+00:00"}]
---

# GROWI: tag and page update APIs let logged-in users read and write restricted pages

GROWI's tag update API and page update API trust a user-controlled key, which bypasses the read permission check. A logged-in attacker can copy contents of pages they cannot read into pages they can edit.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-28T03:31:01+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109848

## From the sources

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_