CVE-2026-84204

GROWI through 8.0.2 contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they are not authorized to view by supplying known attachment identifiers. T...