CVE-2026-84205

GROWI, an open-source wiki/collaboration platform, contains an authorization flaw (CWE-639) in the GET /_api/v3/revisions/:id endpoint: the API checks the caller's read permission against a page identifier passed as a query parameter, but returns the revision identified by the path parameter without verifying that the revision actually belongs to that page. An authenticated attacker with access to any page can therefore supply the accessible page's identifier together with an arbitrary revision identifier belonging to a page they cannot view, and the API returns that restricted revision's content. The impact is limited to confidential information disclosure (high confidentiality impact per the CVSS 4.0 score of 7.1); there is no integrity or availability impact and no privilege escalation. Any GROWI deployment that grants different page-read permissions to different users is affected, though the attacker must hold a valid low-privilege account; the affected version ranges are not specified in the available disclosure data. Exploitation has not been observed: no public proof-of-concept is known, the issue is not in CISA's KEV catalog, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Monitor the GROWI vendor advisory and official GitHub releases for the patched version and upgrade as soon as a fix is published; no fixed version is stated in the available data. As interim measures, restrict which accounts can reach the revisions API and review page-permission assignments. Check access logs for GET /_api/v3/revisions/:id requests in which the page query parameter and the revision path parameter reference different pages, which would indicate probing of restricted content.