CVE-2026-109848

The GROWI platform is vulnerable to an authorization bypass in its tag update API and page update API . This flaw stems from the improper use of a user-controlled key , allowing an authenticated attacker to access the contents of pages for which they lack read permissions. Furthermore, the attack...

EUVD-2026-111556

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and sa...