Threat database

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

GROWI versions prior to 8.0.2 have a missing authorization check for attachment requests when the request is unauthenticated. This allows an unauthenticated attacker with knowledge of an attachment identifier to retrieve files regardless of page privacy or permission settings. Version 8.0.2 fixes this by enforcing permission checks for both authenticated and unauthenticated requests, except when a valid share link is used.

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition.