CVE-2026-109848

LOW 2.3CVE-2026-109848 · Published 28/10/2026 · updated 04/11/2026

In short

CVE-2026-109848 is a LOW (CVSS 2.3) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

References

growilabs/growi security advisory
growi.co.jp/news/48
jvn.jp/en/jp/JVN51223238

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free