Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-105272

Quick assessment

Affected

GROWI, Inc. GROWI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GROWI 的页面查看和评论功能中存在一个授权绕过漏洞，原因是其不当使用了由用户控制的关键参数。利用该漏洞，已认证的攻击者可在未获得必要读取权限的情况下，获取页面的内容及评论。

CVSS 2.3 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GROWI, Inc.	GROWI	v3.2.10 ~ v8.0.6	-

II. Public POCs for CVE-2026-105272

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-105272

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-105272 (2)

Vendor Pages for CVE-2026-105272 (1)

🔗 GROWI 脆弱性対応のお知らせ (JVN#51223238) Read full article

https://www.cve.org/CVERecord?id=CVE-2026-105272

Same Patch Batch · GROWI, Inc. · 2026-10-28 · 3 CVEs total

CVE-2026-115624	6.9 MEDIUM	GROWI 协同编辑功能缺少权限检查漏洞
CVE-2026-109848	2.3 LOW	GROWI 标签与页面更新 API 权限绕过漏洞

IV. Related Vulnerabilities

Same product: GROWI

Same vendor: GROWI, Inc.

Same weakness: CWE-639