CVE-2026-84204

GROWI, an open-source wiki and collaboration platform, contains a missing-authorization vulnerability (CWE-862) in its GET /_api/v3/attachment/:id endpoint. The endpoint returns attachment data without first verifying that the requesting user has permission to view the page the attachment belongs to, so any authenticated user who knows or guesses a valid attachment identifier can query it directly over the network. An attacker gains metadata for attachments stored on pages they cannot otherwise view, and the CVSS 4.0 score rates the confidentiality impact as high. Any GROWI deployment whose users can reach the v3 REST API is affected, since exploitation requires only a valid low-privileged account. No public proof of concept, CISA KEV listing, or known in-the-wild exploitation exists, and EPSS estimates only about a 0.2 percent chance of exploitation within 30 days.

What to do: Upgrade GROWI to the patched release identified in the vendor advisory (no fixed version is given in this data), and until then limit which accounts can reach the v3 API and review /_api/v3/attachment/:id access logs for unusual enumeration. Audit attachments on permission-restricted pages to determine what lower-privileged authenticated users could have viewed.