CVE-2026-80191 json
GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests
published 2026-08-25 2 mo ago modified 2026-09-24 45 d ago also EUVD-2026-66213
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be non-null, so a request that carries no session skips the check entirely and the handler returns the file. The routes reached this way, /attachment/:id and /download/:id, take the attachment identifier from the path, so an unauthenticated caller who has an attachment identifier receives the file regardless of whether the page owning it is private and regardless of whether that caller would be permitted to view the page. Identifiers can be retained by a user whose access was later removed, or recovered from anywhere the identifier was previously exposed. Version 8.0.2 runs the check for authenticated and unauthenticated requests alike, skipping it only where a valid share link has already bound the requested file to that link's page.
Patch / fix
- GROWI, Inc. GROWI 8.0.2
- github.com/growilabs/growi#11756 pull request
- github.com/growilabs/growi/releases/tag/v8.0.2 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.48% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- GROWI, Inc. GROWI
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/growilabs/growi/pull/11756
issue-tracking, patch
-
github.com
/growilabs/growi
product
-
github.com
/growilabs/growi/blob/v8.0.1/apps/app/src/server/routes/attachment/get.ts
technical-description
-
github.com
/growilabs/growi/releases/tag/v8.0.2
release-notes
-
vulncheck.com
/advisories/growi-before-8.0.2-missing-authorization-on-attachment-retrieval-for-unauthenticated-requests
third-party-advisory
Sources
- CVE List CVE-2026-80191
- NVD CVE-2026-80191
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.