Vulnerability Description
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/growilabs/growi/security/advisories/GHSA-pqx5-gx68-83h4
- https://growi.co.jp/news/48/
- https://jvn.jp/en/jp/JVN51223238/
FAQ
What is CVE-2026-109848?
CVE-2026-109848 is a vulnerability with a CVSS score of 4.2 (MEDIUM). GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can l...
How severe is CVE-2026-109848?
CVE-2026-109848 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-109848?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.