CVE-2026-109848

Severity: low (CVSS 2.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-28
Weakness: CWE-639

Description

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

Affected products

WESEEK, Inc. GROWI: from v4.5.5 through v8.0.6

References

https://github.com/growilabs/growi/security/advisories/GHSA-pqx5-gx68-83h4
https://growi.co.jp/news/48/
https://jvn.jp/en/jp/JVN51223238/

Get alerted when CVE-2026-109848 or the next vulnerability affects your stack