CVE-2026-84204 — GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve a…
Published: 2026-09-01 · CVSS: 7.1 · CVSS 4.0
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7