CVE-2026-84205
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
Debilidad
GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.
Referencias
- https://github.com/growilabs/growi
- https://github.com/growilabs/growi/blob/v8.0.2/apps/app/src/server/routes/apiv3/revisions.js
- https://github.com/growilabs/growi/commit/d298e0b1dbbf568c99db657fa0f7e90f72ddc59b
- https://github.com/growilabs/growi/pull/11810
- https://www.vulncheck.com/advisories/growi-through-8.0.2-authorization-bypass-through-user-controlled-key-on-apiv3-revision-retrieval
Encuentra el fallo antes que un atacante.
Inicia sesión con GitHub y ejecuta tu primera auditoría en menos de un minuto. El plan gratuito no requiere tarjeta de crédito.