CVE-2026-84204: GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-01 · updated 2026-09-08
Weakness: CWE-862

Description

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

Affected products

growilabs growi: through 8.0.2

References

https://github.com/growilabs/growi
https://github.com/growilabs/growi/blob/v8.0.2/apps/app/src/server/routes/apiv3/attachment.js
https://github.com/growilabs/growi/commit/d298e0b1dbbf568c99db657fa0f7e90f72ddc59b
https://github.com/growilabs/growi/pull/11810
https://www.vulncheck.com/advisories/growi-through-8.0.2-missing-authorization-on-apiv3-attachment-retrieval

Get alerted when CVE-2026-84204 or the next vulnerability affects your stack