{"id":"CVE-2026-115624","kind":"vulnerability","aliases":["CVE-2026-115624"],"related":[],"title":"GROWI: missing authorization lets read-only users modify page drafts","description":"GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.","summary":"GROWI's collaborative editing feature does not check authorization properly. A read-only user, a guest, or an account in pending, suspended, or invited status can modify page drafts.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["growi","package","self-hosted","wiki"],"not_affected_if":["no-collaborative-editing","no-guest-accounts"],"how_to_check":"- Check the installed GROWI version, for example with `package.json` in the GROWI install directory or the version shown in the admin panel.\n- Review which accounts have read-only access, guest access, or pending, suspended or invited status on the instance.","fix":null,"status":"open","published_at":"2026-10-28T03:17:11+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","triaged_at":"2026-10-28T03:32:39+00:00","updated_at":"2026-10-28T03:32:39+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T03:32:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"GROWI: missing authorization lets read-only users modify page drafts","impact":"medium","summary":"GROWI's collaborative editing feature does not check authorization properly. A read-only user, a guest, or an account in pending, suspended, or invited status can modify page drafts.","category":"package","nicknames":[],"who_cares":["growi","self-hosted","wiki"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privilege users can overwrite page drafts they should not be able to edit.","analyst_note":"Find the fixed GROWI version and the vendor advisory for CVE-2026-115624 on the GROWI project page or GitHub releases.","how_to_check":"- Check the installed GROWI version, for example with `package.json` in the GROWI install directory or the version shown in the admin panel.\n- Review which accounts have read-only access, guest access, or pending, suspended or invited status on the instance.","needs_analyst":true,"not_affected_if":["no-collaborative-editing","no-guest-accounts"],"who_is_affected":"Self-hosted GROWI instances that use the collaborative editing feature and have read-only, guest, or non-active accounts. The sources do not name the fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000563,"input_tokens":3287,"output_tokens":469,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115624':14A,17A '-2026':13A,16A 'account':43B 'author':3A,32B,58C 'check':31B,59C 'collabor':26B,63C 'contain':55C 'cve':12A,15A 'draft':11A,53B,93C 'edit':27B,64C 'exploit':67C 'featur':28B,65C 'growi':1A,18B,24B,54C 'guest':40B,79C 'host':22B 'includ':77C 'invit':48B,88C 'let':4A 'may':90C 'miss':2A,57C 'modifi':9A,51B,91C 'packag':19B 'page':10A,52B,92C 'pend':45B,85C 'permiss':76C 'proper':33B 'read':6A,36B,74C 'read-on':5A,35B,73C 'self':21B 'self-host':20B 'status':49B,89C 'suspend':46B,86C 'user':8A,38B,71C,80C,83C 'vulner':60C,69C 'wiki':23B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted GROWI instances that use the collaborative editing feature and have read-only, guest, or non-active accounts. The sources do not name the fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T03:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vultures@jpcert.or.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115624","severity":null,"published_at":"2026-10-28T03:17:11+00:00","modified_at":"2026-10-28T03:17:11+00:00","first_seen_at":"2026-10-28T03:31:02+00:00","fetched_at":"2026-10-28T03:31:02+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}