CVE-2026-100727

GROWI, Inc. / GROWI PUBLISHED

Description (CNA)

An improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

Affected (CNA)

Vendor / product	Versions
GROWI, Inc. / GROWI	affected 0 before v7.5.5

CWE

CWE-552

References

https://growi.co.jp/news/47
https://jvn.jp/en/jp/JVN24352487/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.