CVE-2026-84204: Missing Authorization in growilabs growi

CVE-2026-84204 describes an access control vulnerability in growilabs' GROWI product. The flaw exists in the GET /_api/v3/attachment/:id API endpoint, which fails to verify whether the requesting authenticated user has permission to view the page associated with the requested attachment. As a result, attackers with valid credentials can retrieve metadata for attachments linked to pages they cannot otherwise access. This vulnerability affects all GROWI versions up to and including 8.0.2. The CVSS 4.0 base score is 7.1, indicating high severity due to network attack vector, low attack complexity, no privileges required beyond authentication, no user interaction, and high impact on confidentiality. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Authenticated attackers can bypass page-level access controls to obtain metadata about attachments from restricted pages. This could lead to unauthorized disclosure of sensitive information contained in attachment metadata. The vulnerability does not allow modification or deletion of data, nor does it impact availability or integrity. The impact is limited to confidentiality of attachment metadata.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the GROWI API endpoints to trusted users only and monitor for suspicious API usage. Consider applying additional access control measures at the network or application layer to limit exposure.