CVE-2026-109848

low

Description

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

References

https://jvn.jp/en/jp/JVN51223238/

https://growi.co.jp/news/48/

https://github.com/growilabs/growi/security/advisories/GHSA-pqx5-gx68-83h4

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111556

Details

Source: Mitre, NVD

Published: 2026-10-28

Updated: 2026-10-28

Risk Information

CVSS v2

Base Score: 3.6

Vector: CVSS2#AV:N/AC:H/Au:S/C:P/I:P/A:N

Severity: Low

CVSS v3

Base Score: 4.2

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 2.3

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Low