CVE-2022-41799: Weseek Growi

Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.

Affected products

• Weseek Growi: from 4.0.0, before 4.5.25 (fixed in 4.5.25); from 5.0.0, before 5.1.4 (fixed in 5.1.4)

Published 2022-10-24. Last modified 2026-06-17.