CVE-2026-25083
Authorization Bypass in GROWI OpenAI API Allows Data Tampering
Publication date: 2026-03-16
Last updated on: 2026-03-16
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| growi | growi | to 7.4.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-25083 is a missing authorization vulnerability found in the OpenAI thread/message API endpoints of GROWI versions 7.4.5 and earlier.'}, {'type': 'paragraph', 'content': "This vulnerability allows a logged-in user who knows a shared AI assistant's identifier to view and potentially tamper with other users' threads and messages without proper authorization."}, {'type': 'paragraph', 'content': 'The issue can be exploited remotely without user interaction but requires some level of privileges.'}] [1, 2]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can lead to unauthorized access and manipulation of other users' AI assistant threads and messages."}, {'type': 'paragraph', 'content': 'Such unauthorized access compromises confidentiality, integrity, and availability of user data within the GROWI system.'}, {'type': 'paragraph', 'content': 'Attackers with some privileges can remotely exploit this vulnerability to view sensitive information or alter messages, potentially causing data breaches or disruption.'}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'To mitigate the vulnerability in GROWI versions 7.4.5 and earlier, users should update GROWI to version 7.4.6 or later, where the issue has been fixed.'}, {'type': 'paragraph', 'content': "This update addresses the missing authorization vulnerability in the OpenAI thread/message API endpoints that allows logged-in users to view or tamper with other users' threads and messages."}] [1, 2]