CVE-2026-109848

Name of the Vulnerable Software and Affected Versions GROWI (affected versions not specified)

Description An authorization bypass exists in the tag update API and the page update API caused by the improper use of a user-controlled key. This allows an authenticated attacker to access the contents of pages for which they lack read permissions and save that information into pages they are authorized to edit.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.