CVE-2026-84204: Growilabs Growi

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.

Affected products

• Growilabs Growi: up to and including 8.0.2

Published 2026-09-01. Last modified 2026-09-08.