CVE-2026-68951
Received Received - Intake

Incorrect Authorization in GROWI Allows Unauthenticated Bookmark Data Access

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: JPCERT/CC

Description
GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-68951
EUVD
EUVD-2026-68370

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
growi growi to 8.0.1 (exc)
growi growi 8.0.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GROWI has an incorrect authorization vulnerability that allows an unauthenticated attacker to access other users' bookmark data.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to bookmark endpoints. Check GROWI logs for unusual requests to /_api/bookmarks endpoints without authentication. Use tools like curl to test if unauthenticated requests return bookmark data: curl -v http://<target>/api/v3/bookmarks

Impact Analysis

An attacker could steal sensitive bookmark data, potentially exposing personal or confidential information stored in bookmarks.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR (privacy) and HIPAA (health data protection) compliance requirements.

Mitigation Strategies

Immediately update GROWI to the latest patched version. If an update is unavailable, restrict access to the /api/v3/bookmarks endpoint via firewall rules. Disable unauthenticated API access if possible. Monitor for suspicious activity and revoke any exposed bookmark data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68951. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart