Threats affecting pkg:github/growilabs/growi

GROWI versions 7.0.0 through 8.0.6 have a missing authorization check vulnerability in the collaborative editing feature. This flaw allows users with read-only permissions, including guest users or users with pending, suspended, or invited status, to modify page drafts. The vulnerability has a medium severity rating with a CVSS score of 5.3.

GROWI contains an authorization bypass vulnerability in its tag update and page update APIs. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents without having the required read permissions and save them to pages they can edit. The vulnerability affects versions from 4.5.5 through 8.0.6. The CVSS score is 4.2, indicating medium severity.

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality. This flaw arises from improper use of a user-controlled key, allowing an authenticated attacker to access page contents and comments without having the necessary read permissions. The vulnerability affects versions from 3.2.10 through 8.0.6. The CVSS score is 4.2, indicating a medium severity level.

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

GROWI versions prior to 8.0.2 have a missing authorization check for attachment requests when the request is unauthenticated. This allows an unauthenticated attacker with knowledge of an attachment identifier to retrieve files regardless of page privacy or permission settings. Version 8.0.2 fixes this by enforcing permission checks for both authenticated and unauthenticated requests, except when a valid share link is used.

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.