Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-115624

Quick assessment

Affected

GROWI, Inc. GROWI

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GROWI 的协同编辑功能中存在一个缺失授权检查的漏洞。利用该漏洞，仅拥有只读权限的用户（包括访客用户），或处于待处理、已暂停或已邀请状态的用户，均可能修改页面草稿。

CVSS 6.9 · Medium Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1548 · Abuse Elevation Control Mechanism

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

N/A

Source: CVE Program / CVE List V5

Vulnerability Description

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GROWI, Inc.	GROWI	v7.0.0 ~ v8.0.6	-

II. Public POCs for CVE-2026-115624

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-115624

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-115624 (2)

Vendor Pages for CVE-2026-115624 (1)

🔗 GROWI 脆弱性対応のお知らせ (JVN#51223238) Read full article

https://www.cve.org/CVERecord?id=CVE-2026-115624

Same Patch Batch · GROWI, Inc. · 2026-10-28 · 3 CVEs total

CVE-2026-105272	2.3 LOW	GROWI 任意版本页面查看与评论权限绕过漏洞
CVE-2026-109848	2.3 LOW	GROWI 标签与页面更新 API 权限绕过漏洞

IV. Related Vulnerabilities

Same product: GROWI

Same vendor: GROWI, Inc.

Same weakness: CWE-862