GROWI has an authorization bypass vulnerability in its tag update and page update APIs. This flaw arises from improper use of a user-controlled key, allowing authenticated attackers to access page contents without proper read permissions and save them to pages they can edit.