CVE-2026-100727

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

Score

CVSS 4.0 6.9 Medium

Status

Deferred - vultures@jpcert.or.jp

Published

2026-10-05

Last modified

2026-10-05

Weaknesses

CWE-552

Affected products

• Growi (Growi Inc.)

References

• https://growi.co.jp/news/47
• https://jvn.jp/en/jp/JVN24352487/