CVE-2026-84205

Medium

Description

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

SeverityMedium

CVSS6.5

Exploit probability—

ProductGrowi

PublishedSep 1, 2026

First seenSep 1, 2026

Weakness typeCWE-639Authorization bypass through user-controlled key

How to fix

Patches

github.com/growilabs/growi/pull/11810
github.com/growilabs/growi/commit/d298e0b1dbbf568c99db657fa0f7e90f72ddc59b

Affected products

Product	Affected versions	Fixed in
growilabs growi	v ≤ 8.0.2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.