Skip to content
OpenAdvisories

Vendor

GROWI

15 known vulnerabilities.

GROWI at a glance

Last 12 months
12
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 1 vulnerability Mar April 2026: 2 vulnerabilities May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 3 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 4 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202640
Sep 202600
Aug 202630
Jul 202600
Jun 202600
May 202610
Apr 202620
Mar 202610
Feb 202600
Jan 202600
Dec 202510
Nov 202510
Oct 202510
Sep 202500
Aug 202500
Jul 202500
Jun 202510
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

GROWI 15
All Critical High Medium Low Exploited only Public exploit

15 results · Feed

  • Medium 5.3
    CVE-2026-115624

    GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vul…

    GROWI GROWI
  • Medium 4.2
    CVE-2026-109848

    GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use …

    GROWI GROWI
  • Medium 4.2
    CVE-2026-105272

    GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper u…

    GROWI GROWI
  • Medium 5.3
    CVE-2026-100727

    An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contain…

    GROWI GROWI
  • Medium 6.3
    CVE-2026-53620

    GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If…

    GROWI GROWI
  • Medium 5.3
    CVE-2026-68951

    GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacke…

    GROWI GROWI
  • High 7.5
    CVE-2026-80191

    GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests

    GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requiring the user to be…

    GROWI GROWI
  • High 7.2
    CVE-2026-41951

    Path traversal vulnerability exists in GROWI v7.5.0 and earlier, which may allow an attacker to execute arbitrary EJS t…

    GROWI GROWI
  • High 7.5
    CVE-2026-41040

    GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input strin…

    GROWI GROWI
  • Medium 5.4
    CVE-2026-26291

    Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an ar…

    GROWI GROWI
  • High 8.3
    CVE-2026-25083

    GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A log…

    GROWI GROWI
  • Medium 4.3
    CVE-2025-64700

    Cross-site request forgery vulnerability exists in GROWI v7.3.3 and earlier. If a user views a malicious page while log…

    GROWI GROWI
  • Medium 5.4
    CVE-2025-61994

    Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing craf…

    GROWI GROWI
  • Medium 6.1
    CVE-2025-54806

    GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a…

    GROWI GROWI
  • Medium 4.3
    CVE-2025-43880

    Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cau…

    GROWI GROWI