CVE-2026-84205: Growilabs Growi

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view.

Affected products

• Growilabs Growi: up to and including 8.0.2

Published 2026-09-01. Last modified 2026-09-08.