CVE-2026-115624

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-28
Weakness: CWE-862

Description

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

Affected products

WESEEK, Inc. GROWI: from v7.0.0 through v8.0.6

References

https://github.com/growilabs/growi/security/advisories/GHSA-3v2v-8q3r-mhm4
https://growi.co.jp/news/48/
https://jvn.jp/en/jp/JVN51223238/

Get alerted when CVE-2026-115624 or the next vulnerability affects your stack