Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-109848

Quick assessment

Affected

GROWI, Inc. GROWI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GROWI 的标签更新 API 和页面更新 API 中存在一个授权绕过漏洞，原因是其不当使用了由用户控制的关键参数。利用该漏洞，能够登录该产品的攻击者可以在未获得必要读取权限的情况下获取页面内容，并将这些内容保存到攻击者可编辑的页面中。

CVSS 2.3 · Low Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1548.002 · Bypass User Account Control

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GROWI, Inc.	GROWI	v4.5.5 ~ v8.0.6	-

II. Public POCs for CVE-2026-109848

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-109848

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-109848 (2)

Vendor Pages for CVE-2026-109848 (1)

🔗 GROWI 脆弱性対応のお知らせ (JVN#51223238) Read full article

https://www.cve.org/CVERecord?id=CVE-2026-109848

Same Patch Batch · GROWI, Inc. · 2026-10-28 · 3 CVEs total

CVE-2026-115624	6.9 MEDIUM	GROWI 协同编辑功能缺少权限检查漏洞
CVE-2026-105272	2.3 LOW	GROWI 任意版本页面查看与评论权限绕过漏洞

IV. Related Vulnerabilities

Same product: GROWI

Same vendor: GROWI, Inc.

Same weakness: CWE-639