CVE-2026-115624
Deferred Deferred - Pending Action

Missing Authorization in GROWI Allows Draft Modification

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: JPCERT/CC

Description
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-115624
EUVD
EUVD-2026-111557

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
GROWI, Inc. GROWI v7.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GROWI has a missing authorization check in its collaborative editing feature. This allows users with read-only permissions, including guests or users in pending, suspended, or invited status, to modify page drafts despite not having proper access rights.

Impact Analysis

An attacker could exploit this to alter drafts they shouldn't have access to, potentially leading to unauthorized changes in documents, data integrity issues, or misinformation being introduced into collaborative content.

Compliance Impact

This vulnerability could lead to unauthorized modifications of sensitive data, violating integrity requirements in GDPR and HIPAA. It may result in non-compliance due to lack of proper access controls and audit trails for data changes.

Mitigation Strategies

Update GROWI to the latest version that addresses the missing authorization check in collaborative editing. Review and restrict permissions for guest users and users in pending, suspended, or invited status to prevent unauthorized draft modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart