CVE-2026-80191

Name of the Vulnerable Software and Affected Versions GROWI versions prior to 8.0.2

Description An authorization bypass exists when retrieving attachments. The system only applies page-viewer permission checks to attachment requests if the request is from an authenticated user. In the retrieveAttachmentFromIdParam() function located in apps/app/src/server/routes/attachment/get.ts, the permission check is guarded by a condition that requires the user to be non-null. Consequently, requests without a session skip this check entirely, allowing unauthenticated callers with a valid attachment identifier to access files via the '/attachment/:id' and '/download/:id' endpoints. This occurs regardless of whether the page owning the attachment is private or if the caller has the necessary permissions. Access is possible if identifiers were previously exposed or retained by users whose access was subsequently revoked.

Recommendations Update GROWI to version 8.0.2.