CVE-2026-25083

Name of the Vulnerable Software and Affected Versions GROWI versions prior to 7.4.5

Description The GROWI OpenAI thread/message API endpoints do not perform proper authorization checks. A logged-in user who has access to a shared AI assistant's identifier can potentially view and modify other users' threads and messages. The affected API endpoints allow unauthorized access to sensitive data and potential tampering with user communications.

Recommendations Versions prior to 7.4.5 should be updated.