Live › vulnerability › CVE-2026-115624
Go to dashboardGROWI's collaborative editing feature does not check authorization properly. A read-only user, a guest, or an account in pending, suspended, or invited status can modify page drafts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 03:31 UTC. All times on this page are UTC.
Self-hosted GROWI instances that use the collaborative editing feature and have read-only, guest, or non-active accounts. The sources do not name the fixed version.
No product ranges from the sources yet.
package.json in the GROWI install directory or the version shown in the admin panel.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
This page as .md · .json · in your agent: get_signal("CVE-2026-115624")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.