GROWI has an authorization bypass vulnerability affecting its page viewing and commenting features. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents and comments without proper read permissions. The vulnerability has a medium severity rating with a CVSS score of 4.2.